OpenCode said on October 17 that a security breach hit its Console product, exposing provider API keys for 1.4% of users who had linked external provider accounts. The company posted the disclosure on its official account, and as of October 18 the incident is still open. That is the full extent of what OpenCode has confirmed in writing: a percentage, a product surface, and a status of ongoing.
A 1.4% figure sounds small until it is measured against how Console is used. Anyone running OpenCode's Console typically links it to provider accounts to manage API keys across services, which means the affected slice is not random noise but a specific population with credentials that reach outward into other systems. OpenCode's post does not say which providers are involved, how the keys were accessed, or when the exposure began. It also does not say whether the 1.4% figure is final or will grow as the investigation continues.
What OpenCode has not said matters as much as what it has. The announcement does not state a root cause, does not name a vendor or infrastructure component responsible, and does not give a timeline for resolution. It does not confirm whether exposed keys were used by an attacker or merely accessible. Those are the open questions. Anything beyond the percentage and the ongoing status is speculation until OpenCode publishes more, and on-call teams should treat early chatter about cause or scope accordingly, separating what the company has stated from what has simply been repeated online.
For on-call engineers, the operational task is narrow and immediate: check whether any provider API key was ever linked to an OpenCode Console account, regardless of whether current usage looks active. Keys get linked once and forgotten. If a match exists, rotate it now rather than waiting for OpenCode to confirm individual exposure, because the company has not said it will notify affected accounts directly or on what schedule. Review provider-side access logs for unusual calls tied to those keys, especially since the incident is still open and the exposure window has not been closed or dated.
The 1.4% figure also raises a scaling question platform operators should not ignore. If Console's user base runs into the tens or hundreds of thousands, a small percentage still translates into a meaningful number of exposed credentials across unrelated organizations. Nothing in OpenCode's post ties the breach to a specific attack vector, so defensive steps have to be broad: rotate, audit, and assume linkage rather than wait for a root-cause report. Few incidents stay this quiet for long.
OpenCode has not issued a follow-up post as of October 18, and the incident status remains open with no stated resolution time.