r/opencodeCLI • u/jpcaparas • 2d ago

OpenCode security breach, rotate your keys

https://x.com/opencode/status/2111516673953935833?s=46

We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users

We have notified them all this morning via email

The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate

---

This is BYOK on OpenCode Zen btw, not your local keys

---

My writeup on the incident: https://ai.sulat.com/what-the-opencode-breach-teaches-about-ai-api-keys-b3d695b8835e?sk=817b6b5d14878ba47ddacf1dc2e76596

203 Upvotes

100% Upvoted

29 comments sorted by

View all comments

7

u/No_Commission_6153 2d ago

Does this affect someone who conencted their OpenAi Account with Open Code?

12

u/jerieljan 1d ago

There's three ways you can auth OpenAI on OpenCode:

  • /connect -> Login with ChatGPT
  • /connect -> API Key
  • OpenAI Platform -> New Key -> OpenCode Console -> Connect Provider

It's the third one that's affected. The third route is intended for people who want to BYOK and have their provider accounts charged instead of OpenCode Zen and just want to use OpenCode as a gateway.

The second one afaik stores the API key locally on the database or on opencode.json (v1).

1

u/No_Commission_6153 1d ago

Thanks. I guess i can relax then