Act on this, mostly signal

OpenCode Console breach exposed API keys for 1.4% of users

What to do

Rotate API keys if you used the older OpenCode Console, and check AI account charges.

Why

Attackers breached an older Console system. The open-source app and CLI were not affected, and OpenAI is refunding credits.

Read the source at techcrunch.com

What the research found

OpenCode said attackers breached an older OpenCode Console system, exposing API keys for 1.4% of Console users and generating unauthorized AI charges. The open-source app and CLI were not affected, and OpenAI is refunding credits.

Claims and how well the evidence supports them

OpenCode attack affected 1.4% of OpenCode Console users 99%
Open-source OpenCode app and CLI were not affected; only Console keys were exposed 98%
OpenAI agreed to refund API customers for credits used in the attack 96%

Evidence

techcrunch.com https://techcrunch.com/2026/10/19/hackers-hit-ai-coding-tool-opencode-running-up-charges-on-users-ai-accounts

Actionability rated high.