OpenCode
LowReportedDigital services
On the night of 16 to 17 October 2026, OpenCode suffered unauthorised access to a legacy system that was being decommissioned. The company states that 1.4% of users of its OpenCode Console platform are affected, limited to those who had connected external AI providers. The API keys for those providers (including OpenAI, Anthropic or Google), stored in their workspaces, may have been exposed. Keys stored only locally in the OpenCode client are not mentioned in the alert.
An exposed API key lets a third party send requests to the provider's models in the key owner's name and at their expense.
- Disclosed on
- October 17, 2026
- Incident dated
- October 17, 2026
- Sector
- Digital services
- Country
- International or undetermined
- Cause
- Undisclosed
Exposed data
- Other personal data
You are only affected if you had an account or an order with this organisation.
What you can do
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact