On October 18, 2026, Dax Raad said attackers had been trying to access OpenCode systems during the preceding 48 hours and that the company was hardening its systems. A day earlier, OpenCode said an intrusion the previous night may have exposed provider API keys saved in OpenCode Console. It said 1.4% of Console users with external providers linked were affected and that it had emailed them. Raad’s October 18 update and OpenCode’s October 17 disclosure give the latest dated statements.
First identify where the key was stored
OpenCode co-founder Dax Raad said the incident involved OpenCode Console, not the OpenCode application. OpenCode’s CLI provider documentation describes a separate local storage path: saved API keys and OAuth tokens reside in the server’s SQLite database, usually at ~/.local/share/opencode/opencode.db. The path can vary with XDG_DATA_HOME, the release channel, or OPENCODE_DB.
The same documentation says supported environment credentials are read by the server process and are not saved as accounts. For a local setup, check which authentication method you configured and where its credentials are stored. The documentation describes the local setup; it does not identify every configuration assessed in the Console incident.
OpenCode’s Console provider documentation describes Console as a gateway: it adds a connected provider credential before forwarding a request. That distinction helps you identify whether the credential you use belongs to the hosted Console or your local server.
Revoke a potentially exposed key with its provider
Removing a credential from Console is not the same as revoking it with the provider. The Hacker News reported that a provider key remains usable until the provider revokes it. OpenAI’s account security guidance directs users who suspect an API key was compromised to delete it in the API dashboard, review usage, and contact support.
The Hacker News also reported that OpenCode advised affected users to review provider activity from at least October 16, the night before the company’s disclosure. OpenCode’s documentation says Console requests count toward Console budgets, while providers bill for token usage. The Hacker News noted that a Console budget would not cap use of a copied provider key outside the gateway.
If an OpenAI account is deactivated
OpenAI says to appeal through the link in the deactivation notice or its official appeal intake form. If you did not receive a notice and have lost account access, OpenAI directs you to Help Center chat. Its deactivation guidance asks users in that situation to provide account identifiers, relevant usage context, the suspected-compromise date range, and steps already taken.
Raad’s October 18 statement described attempts to access OpenCode systems over the preceding 48 hours and said the company was hardening its systems.
