OpenCode Hacked: User credentials leaked
Points and comments are a snapshot, not live.
Hacker steals user credentials from OpenCode Console in a distillation attack.
OpenCode announced a security breach on X from a large scale distillation attack, impacting 1.4% of OpenCode Console users. The incident is ongoing, and they are working with Anthropic, OpenAI, and Google to remediate. Affected users were notified via email. OpenCode later clarified in an HN comment that unauthorized access to a legacy system exposed third-party provider keys (e.g., OpenAI, Anthropic) saved in workspaces; they advised revoking and replacing those keys.
What commenters are saying
Commenters debate the scope of the breach and whether OpenCode downplayed it. Many stress the breach affected only the hosted Console service, not the CLI: users who stored API keys in OpenCode's cloud should revoke them. A previous warning about OpenCode's data practices is cited. Some accuse OpenCode of vague, non-transparent disclosure; others note details are withheld because the attack is ongoing. A few point out OpenCode is a YC company.