OpenCode is the subject of reports that user credentials may have been leaked. A credential leak can put accounts at risk if information such as passwords, access tokens or API keys is exposed. The research provided for this explainer does not confirm which types of credentials were involved, how the leak happened, or how many users could be affected.

The topic may be appearing in trend lists because of wider attention to AI tools and security risks. Recent headlines in the supplied context include coverage of AI misuse, warnings about OpenClaw, and a cybersecurity bulletin spanning several threats. None of those headlines specifically confirms an OpenCode incident, so they do not establish why this report is trending or verify its details.

Users should look for a notice from OpenCode through its official website or account channels, and avoid relying on unsourced claims about the incident. If OpenCode confirms that a password, token or API key was exposed, change or revoke the affected credential and replace it with a new one. Reusing passwords across services can increase the consequences of a leak, so update any other accounts that share the same password.

Turn on multifactor authentication where available, review recent account activity, and watch for unexpected sign-in alerts or requests to reset credentials. Do not share passwords or verification codes in response to messages claiming to help with the incident. Until an official account of the exposure is available, the affected data, scope and cause remain unconfirmed.