The OpenCode breach: why local AI puts you in control

Your AI API key gives software permission to spend money on your account. When you put that key into someone else's platform, their security becomes part of your operating risk.

OpenCode's October 17, 2026 breach disclosure makes that dependency concrete. It also explains one of the strongest reasons to run AI locally: you can choose where the model runs, where your information stays, and which outside services your business needs to trust.

What happened at OpenCode

In its October 17 statement, OpenCode said a breach the previous night affected 1.4% of OpenCode Console users. The affected group was a subset with external providers linked. OpenCode said it had emailed everyone affected and that users who did not receive an email were not impacted. It described the incident as ongoing and said it was working with Anthropic, OpenAI, and Google.

The company linked the breach to a large-scale distillation attack. That is its characterization; the statement does not explain the intrusion method or establish who carried it out.

A customer notice reproduced on Hacker News says an unauthorized party accessed a legacy system being decommissioned. Third-party provider keys saved in workspaces, including OpenAI and Anthropic credentials, may have been exposed.

Notebookcheck reports that users described unexpected charges, including one report of $400 on Anthropic and another of approximately €200 on Google. These are individual reports, not an audited loss total.

The disclosed scope is hosted Console accounts with linked providers. The statement does not establish that every OpenCode installation, its open-source CLI, or locally stored credentials were compromised.

How big is OpenCode—and what would 1.5% mean?

OpenCode is a substantial project. Its homepage, checked October 17, advertises over 16 million developers every month, over 208,000 GitHub stars, 950 contributors, and over 13,000 commits. These are OpenCode's own published figures; stars measure repository interest and are not a count of customers.

A small percentage can represent a large number of people. Here is the arithmetic, using hypothetical populations:

Those are illustrations, not estimates of this breach. The disclosed percentage is 1.4%, and its denominator is Console users. OpenCode's 16 million monthly developers describe the broader product audience. The statement does not give a Console user total or an absolute affected-user count, so multiplying those two different populations together would produce an unsupported claim.

At 1.5%, the arithmetic is 15 people in every 1,000. At the reported 1.4%, it is 14 in every 1,000. Either way, the consequence for an affected business can include credential replacement, billing disputes, interrupted integrations, and time spent investigating what happened.

An API key is permission to use your account

OpenCode's Console documentation explains the arrangement: Console stores a provider credential and routes requests through its gateway, allowing workspace members to use models without seeing the original key. The external provider bills the account for tokens.

That is useful administration. It also creates another place where a valuable credential must be protected. A stolen provider key may let an attacker call the provider directly, subject to the key's permissions and the provider's controls. Removing a key from a gateway does not by itself prove that the provider has revoked it.

For affected users, the customer notice calls for revoking and replacing the provider keys, updating applications that use them, and checking recent usage. Rotate credentials at the relevant provider, then update the integrations that need the replacement.

What local AI puts under your control

In a fully local inference workflow, the model runs on hardware you control. The computation that produces the answer does not require a paid cloud model account. If that workflow has no external model key, there is no external model key for a hosted gateway to expose.

That changes several practical decisions:

• Where processing happens. You choose the machine that handles prompts, documents, and model responses.
• Who can reach it. You control device access, network access, and which staff or applications can use the model service.
• What gets retained. You set policies for local chat history, logs, document indexes, and backups.
• When outside services are used. You can make cloud calls an explicit exception for approved tasks.
• How compute is paid for. Local inference uses your hardware and electricity, with maintenance and support costs, rather than a cloud provider's per-token meter.

Consider a firm summarizing a client document. With local inference, local document storage, and local retrieval, the document and the summary can stay inside the firm's environment. Adding a cloud embedding service, external search tool, or hosted fallback changes that boundary. Each connection needs a deliberate decision.

This is a concrete configuration choice. Ollama documents a local-only mode that disables its cloud models and web search. Its FAQ also says local operation does not send prompts and data back to Ollama. A downloaded model and a controlled local workflow can therefore remove the hosted inference dependency for suitable work.

Local control still requires good operations

A desktop app can call a remote model. An open-source model can run in someone else's cloud. A local model can have tools that send information elsewhere. OpenCode itself supports local models; the relevant choice is the deployment and its connections.

Local systems still need updates, access controls, protected backups, and limits on what agents can read or execute. Compromised devices and exposed model servers can still cause harm. Model quality, speed, memory requirements, and staff support also need to fit the work.

The benefit is a smaller set of external dependencies and direct authority over more of the system. You can inspect the configuration, restrict network access, choose retention rules, and stop the service yourself.

Start with one workflow you want to own

Choose a recurring task involving sensitive information: internal document search, intake summaries, or drafting from approved client records. Map its model, storage, retrieval, logs, tools, and backups. Then test whether the complete task can run inside the boundary you want, with acceptable quality and human review.

That is the approach behind Looski's on-premises AI work: put useful AI close to your business's information and make access, data movement, and operating responsibilities explicit.

The OpenCode incident is a timely reason to ask where your AI credentials and data actually live. With a carefully configured local workflow, more of that answer can be: with you.

Sources checked October 17, 2026. This is a developing incident; the figures above reflect the cited disclosure. Cover: reused Looski illustration of private AI in a controlled office.