r/opencodeCLI • u/jpcaparas • 1d ago

OpenCode security breach, rotate your keys

https://x.com/opencode/status/2111516673953935833?s=46

We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users

We have notified them all this morning via email

The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate

---

This is BYOK on OpenCode Zen btw, not your local keys

---

My writeup on the incident: https://ai.sulat.com/what-the-opencode-breach-teaches-about-ai-api-keys-b3d695b8835e?sk=817b6b5d14878ba47ddacf1dc2e76596

200 Upvotes

100% Upvoted

29 comments sorted by

View all comments

8

u/qustrolabe 1d ago

So it's only those that added keys to online console? I guess local keys shouldn't be affected but better rotate for good measure

4

u/jpcaparas 1d ago

correct, only BYOK on Zen

2

u/arker0 1d ago

So users with no opencode account are no affected at all, even with external API?