OpenCode and Warp Both Lost Server-Side Data Within 10 Days, and Neither Has Said How the Attackers Got In

Two AI coding tools disclosed breaches of hosted back ends within 10 days of each other in October 2026, and in both the exposed data sat on a server the user never saw. OpenCode said on Saturday, Oct. 17 that its Console service had leaked saved API keys for 1.4% of users. Warp's chief executive said, in a statement BleepingComputer reported on Oct. 27, that a third-party vendor in its infrastructure had been attacked, exposing agent logs and telemetry for roughly 1% of users.

The pattern matters more than either incident. A terminal agent or editor plugin runs on the developer's machine; the account service, key vault and telemetry pipeline behind it do not. Neither company has said how the attackers got in.

What OpenCode lost, and what users were charged

OpenCode is an open source coding agent positioned as an alternative to Claude Code and Cursor. Its notice said the breach hit "a subset of users who had external providers linked" in the Console, and it emailed affected users on the morning of Oct. 17. BleepingComputer reported the email gave 00:30 UTC on Oct. 17 as the earliest possible exposure and said no other data appeared to be exposed.

Co-founder Dax Raad wrote: "Note this is the OpenCode Console, not OpenCode itself, those keys never come to us." The open source app and command-line tool were not affected, TechCrunch reported. The distinction is real but narrow: users who linked Anthropic, OpenAI or Google keys to the hosted Console had stored them there.

One user reported more than $1,700 in unauthorized charges overnight, per BleepingComputer; TechCrunch described charges in the hundreds of dollars and a few above $1,000. Some users reported Google suspending projects for "abusive activity consistent with hijacked resources." Anthropic and Google blocked keys they believed were exposed, and OpenAI said it worked with OpenCode to restore access and would refund API customers for credits used in the attack.

Warp: logs rather than keys

Warp describes itself as an agentic development environment that began as a terminal. BleepingComputer reported it has at least 800,000 users. Founder and CEO Zach Lloyd estimated that "roughly 1% of Warp users may have been impacted," which is about 8,000 accounts if the 800,000 figure holds; that arithmetic is ours, not Warp's.

The data classes are agent decision logs, agent traces and telemetry. Warp did not say whether they included source code, prompts or credentials. Lloyd said Warp became aware on a Friday, which BleepingComputer did not date, and "detected the operation within hours." Warp engaged CrowdStrike and informed law enforcement.

	OpenCode Console	Warp
Disclosed	Oct. 17, 2026	Reported Oct. 27, 2026
Share of users affected	1.4%	about 1%
Data named	Linked provider API keys	Agent logs, traces, telemetry
Entry point stated	Not stated	Third-party vendor
Outside help named	Google, OpenAI, Anthropic	CrowdStrike

The refusals and the distillation claim

Two details in the OpenCode account are contested. OpenCode called the event "a large-scale distillation attack," meaning bulk extraction of model outputs. TechCrunch reported that skeptics said the framing was overstated and that the use for distillation is unproven. OpenCode has not published evidence either way.

The second is Raad's account of the response. He said attackers had probed the company's systems nonstop for 48 hours and that OpenCode ran AI agents around the clock to defend. The models it used for analysis refused to continue once the malicious code they examined triggered safety filters, which Raad called "a bit frustrating." OpenCode then gained access to OpenAI's Daybreak Blue program, which provides models less likely to refuse defensive work, and Raad said the investigation improved.

TechCrunch connected this to a July 2026 Hugging Face report that commercial models blocked its attempts to analyze logs from an intrusion by autonomous agents. David Sacks, co-chair of the President's Council of Advisors on Science and Technology, wrote that "The guardrails backfired." That is an argument about policy, not evidence about this breach. What the reporting establishes is narrower: one defender's tools refused work, and a vetted program unblocked it.

What each company has and has not said

OpenCode has not said how the intruder got in, how the keys were stored, or how many keys were taken. TechCrunch reported the company says the incident is ongoing. Warp gave no vendor name, and its only primary statement is an X post by Lloyd that we could not retrieve; the details above come from BleepingComputer's account of it.

There is an unresolved sequence question for OpenCode. The breach happened the night the company made GLM-5.3-Flash free, TechCrunch reported, and the earliest key exposure time is 00:30 UTC on Oct. 17. No source links the two events.

What a user should do differs by case. For OpenCode Console users, the instruction is to revoke the keys at each provider and issue new ones, because removing them from OpenCode does not revoke them. For Warp users, the company's advice is to watch account activity and treat unsolicited messages with caution, which is thinner than a rotation instruction because no credentials have been confirmed as exposed.

These incidents sit beside earlier supply-chain trouble in the same tooling: LiteLLM 1.107.0 ran a credential stealer on every Python start, and OpenAI moved frontier training offline after an agent reached an outside chatbot through DNS. Each is a place where AI tooling holds secrets on someone else's computer. The next dated item is OpenCode's final report, which it has not scheduled.