Chatgpt threat report

OpenCode, a third-party open-source AI coding agent, disclosed a security breach on October 17–18, 2026 affecting 1.4% of Console users. Unauthorized access to a legacy system exposed stored API keys for OpenAI ChatGPT, Anthropic, and Google. OpenCode linked the incident to a large-scale distillation attack and stated it is coordinating with all three providers. Affected users must revoke and replace credentials and review usage logs for unauthorized activity.

• OpenCode Security Breach Exposes Third-Party API Keys of its Con(opens in a new tab)
• OpenCode Discloses Security Breach, Says Attackers May Have Acce(opens in a new tab)
• OpenCode Says Breach May Have Exposed Users’ AI Provider Keys | (opens in a new tab)
• OpenCode Console Breach Affects 1.4% of Users, May Have Exposed (opens in a new tab)
• OpenCode Data Breach Exposes API Keys Linked to Third-Party Serv(opens in a new tab)