Pinned
OpenCode's hosted Console was hit by an attack. About 1.4% of users, the ones who stored their own OpenAI, Anthropic or Google keys there, may have had those keys exposed.
Got their email? Revoke the keys in each provider's own dashboard (not through email links), check your
We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers
