OpenCode Console breach (October 2026): my OpenAI / Anthropic / Google API keys may be exposed and I see unauthorized charges. What should I do?

What happened: OpenCode told users that API keys for external providers (OpenAI, Anthropic, Google) stored in OpenCode Console workspaces may have been exposed in a breach it disclosed on October 19, 2026. The earliest possible exposure was October 17, 2026, 00:30 UTC, and about 1.4% of Console users were affected. Some users saw large unauthorized API charges overnight, and some Google Cloud projects were suspended. Anthropic and Google blocked keys they believed were exposed, and OpenAI said it was refunding affected credits. OpenCode linked the attack to a large-scale 'distillation' effort (stolen keys used to run heavy model traffic). Am I affected? If you saved any provider API key in an OpenCode Console workspace before October 19, 2026, treat it as exposed, even if you didn't get an email. The local OpenCode CLI with keys only on your machine is not part of this incident. What to do: 1. Revoke the keys at each provider (OpenAI, Anthropic Console, Google AI Studio / Google Cloud) and create new ones. Deleting the key from OpenCode is not enough. 2. Check each provider's usage and billing pages from October 17 onward for traffic you didn't make; note the times and amounts. 3. Contact provider support about refunds and, for Google Cloud, any project suspension. 4. Set spending limits or budget alerts on every provider account. 5. Give new keys only to tools that need them, preferably with per-project keys so one leak doesn't hit everything. After: confirm the old keys are rejected (a test call returns an auth error), and keep watching usage for a few days. Sources: https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/ https://techcrunch.com/2026/10/19/hackers-hit-ai-coding-tool-opencode-running-up-charges-on-users-ai-accounts/