OpenCode Breach Could Affect OpenAI, Anthropic and Google
On October 17, OpenCode confirmed a security breach that occurred the night before and affected its Console service, which allows teams to share access to AI models through centrally managed API credentials.
On October 17, OpenCode confirmed a security breach that occurred the night before and affected its Console service, which allows teams to share access to AI models through centrally managed API credentials.
Rather than exposing the underlying OpenAI, Anthropic or Google keys to individual team members, Console stores each workspace’s credentials and uses them to authenticate requests to the respective providers.
OpenCode is a widely used AI agent platform designed for software developers.
In a July 2026 interview with Y Combinator – financial backer of Anomaly, the company which develops and maintains OpenCode – the founder and CEO Jay V claimed OpenCode had reached approximately 13 million monthly active users and 4.6 million weekly active users.
If you did not get an email you were not impacted, it was a subset of users who had external providers linked,” the company added.
The email said OpenCode had and that Specifically, Dax Raad, one of the main contributors to OpenCode and co-founder of Anomaly, noted on X that the breach involved only OpenCode also notified Anthropic, OpenAI and Google to remediate the issue.
The email was made public by several OpenCode users on the dedicated subreddit forum and the official Discord channel.
In an incident response report , software supply chain security firm Safeguard provided recommendations for OpenCode users to identify whether they have been affected by the incident and mitigate its impact:
What happened
On October 17, OpenCode confirmed a security breach that occurred the night before and affected its Console service, which allows teams to share access to AI models through centrally managed API credentials.
Rather than exposing the underlying OpenAI, Anthropic or Google keys to individual team members, Console stores each workspace’s credentials and uses them to authenticate requests to the respective providers.
OpenCode is a widely used AI agent platform designed for software developers.
What changed
In a July 2026 interview with Y Combinator – financial backer of Anomaly, the company which develops and maintains OpenCode – the founder and CEO Jay V claimed OpenCode had reached approximately 13 million monthly active users and 4.6 million weekly active users.
If you did not get an email you were not impacted, it was a subset of users who had external providers linked,” the company added.
The email said OpenCode had and that Specifically, Dax Raad, one of the main contributors to OpenCode and co-founder of Anomaly, noted on X that the breach involved only OpenCode also notified Anthropic, OpenAI and Google to remediate the issue.
Who is affected
The email was made public by several OpenCode users on the dedicated subreddit forum and the official Discord channel.
In an incident response report , software supply chain security firm Safeguard provided recommendations for OpenCode users to identify whether they have been affected by the incident and mitigate its impact:
Attribution
Infosecurity Magazine: On October 17, OpenCode confirmed a security breach that occurred the night before and affected its Console service, which allows teams to share access to AI models through centrally managed API credentials.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.