OpenCode Console breach exposed saved OpenAI, Anthropic and Google API keys

What OpenCode disclosed

OpenCode posted on X on Saturday 17 October at 18:08 UTC: "We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users." It said every affected user had been emailed that morning, that anyone without an email was not affected, and that it was working with Anthropic, OpenAI and Google to remediate.

The email, reported under the subject "Action Required: Potential provider key breach", was more specific: "We identified unauthorized access to a legacy system that we were in the process of decommissioning. Third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed." Recipients were told to revoke and replace those keys in each provider's dashboard, update any application that used them and review recent usage.

BleepingComputer puts the earliest exposure at 00:30 UTC on 17 October. TechCrunch, BleepingComputer and Infosecurity Magazine all reported the breach on Monday 19 October. As of 20 October OpenCode had not named the attacker or published a post-mortem.

Console users, not the open-source tool

OpenCode says it is used by more than 16 million developers a month and has over 208,000 GitHub stars. Most of them run the open-source agent locally, and that is not what was breached. Co-founder Dax Raad stressed the point on X: "note this is the OpenCode Console, not OpenCode itself, those keys never come to us." A key you configure in the local app stays on your machine.

Console is OpenCode's optional hosted service. Its Providers feature lets a team "connect provider accounts you already pay for, such as Anthropic, OpenAI, or AWS Bedrock" and share those models across a workspace. Console stores the credential and serves each provider through its gateway, so members never see the raw key. The intruder reached a legacy system that was being retired, not, as far as OpenCode has said, the current gateway itself.

Overnight charges users reported

The first sign for many victims was a billing alert. Developer Colin Parsons said his OpenAI key was "pounded for $281 of usage, starting at 2am eastern" and his Anthropic key ran up $168 over the same window, more than $400 overnight on keys he used only in OpenCode. He also noticed OpenCode's Discord filling with bot sign-ups at the same time. A widely shared post cited another user at $1,700.

Chris Sinco said his OpenAI, Anthropic and Google AI spend alerts all fired overnight, but "only Google went ahead and suspended the project for suspicious activity". Another user, Alex Spinu, posted screenshots of his Google Cloud project being suspended after the breach. These figures are user reports, not numbers from OpenCode or the providers.

How Anthropic, Google and OpenAI responded

• Anthropic: Lydia Hallie of the Claude Code team said Anthropic had worked with OpenCode and "revoked Claude API keys we believe were affected", adding that anyone who saved a key in OpenCode should create a new one to be safe.
• Google: Evan Otero of Google DeepMind said Google had blocked exposed Gemini API keys and told users to create a new key in AI Studio, delete the old one, review usage and contact Google Cloud Billing support about charges they did not make.
• OpenAI: Tibo of the Codex team said OpenAI worked with OpenCode to get affected API customers "back in business" and refund any credits drawn in the attack.
• OpenCode: Raad said on 18 October that "we already contacted everyone, refunds are already underway".

Raad also said the attackers had been "non stop trying to attack our systems for the past 48 hours" and appeared to be running AI agents around the clock, which forced OpenCode to harden everything in response.

Why "distillation" raised eyebrows

Distillation usually means harvesting a model's outputs at volume to train a cheaper copy. Stolen API keys would be a way to pay for that harvesting with someone else's money, which may be what OpenCode means. But the company has not published evidence for the framing, and AI researcher Nathan Lambert was openly sceptical: "There's something very odd going on with 'distillation' if a cyber attack to steal api keys is looped under the same term."

Whatever the motive, the mechanics for victims were the same as any credential theft: a valid key used by someone else, billed to the owner until it is revoked.

AI defenders hit safety refusals mid-incident

One detail has turned the breach into a policy talking point. Raad said frontier models OpenCode used to investigate "did quite a bit and then started refusing" partway through the incident, and that things improved once the team got access to Daybreak Blue, which OpenAI's Tibo describes as its "cyber permissive setup for defense" that defenders can request.

David Sacks seized on it, arguing that OpenCode, and Hugging Face before it, "hit the same wall mid-attack" when safety filters blocked analysis of the exploits needed for defense, and that "the guardrails backfired". That is his opinion, but the trade-off is real: attackers using agents do not wait for a model to change its mind.

What to do if you used OpenCode Console

1. Check your inbox for OpenCode's "Action Required: Potential provider key breach" email. OpenCode says users who did not get one were not affected.
2. Revoke and replace every provider key you saved in Console, directly at the provider: Anthropic Console, the OpenAI platform and Google AI Studio. Do this even if the provider says it already revoked the key.
3. Update every app, script and CI job that used the old key.
4. Review usage and billing from 16 October onward for anything you did not run.
5. Contact the provider's billing support about charges you did not make. Google points users to Google Cloud Billing support.
6. Set spend limits and alerts at the provider, not only in the tool.

Why it matters

Hosted gateways that hold a team's provider keys are convenient: one place to share models, track spend and hide credentials from individual members. They are also a single place to steal many keys at once. OpenCode's breach came through a system it was already retiring, a reminder that old infrastructure keeps its secrets until it is actually switched off.

It follows the GhostAction campaign reported here on 12 October, which also targeted cloud and AI keys. For developers the takeaway is the same: treat AI provider keys like cloud root credentials, scope and cap them at the provider, and rotate them the moment a service that held them reports a breach.

Sources

• OpenCode on X, 17 October 2026: https://x.com/opencode/status/2111519637049319818
• Dax Raad on X: https://x.com/thdxr/status/2111572618340188393
• Anthropic (Lydia Hallie) on X: https://x.com/lydiahallie/status/2111563956666110287
• Google (Evan Otero) on X: https://x.com/EvanOtero/status/2111591525876474100
• OpenAI (Tibo) on X: https://x.com/thsottiaux/status/2112034063934742720
• OpenCode Console Providers docs: https://opencode.ai/v2/docs/console/providers/
• TechCrunch: https://techcrunch.com/2026/10/19/hackers-hit-ai-coding-tool-opencode-running-up-charges-on-users-ai-accounts/
• BleepingComputer: https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/
• Infosecurity Magazine: https://www.infosecurity-magazine.com/news/opencode-breach-openai-anthropic/

Key takeaways

• An intruder reached a legacy OpenCode Console system on 16-17 October 2026 and exposed provider keys saved by 1.4% of Console users.
• The open-source OpenCode app was not breached; locally configured keys never reach OpenCode's servers.
• Users reported hundreds of dollars of rogue OpenAI, Anthropic and Google usage overnight, with one report of $1,700.
• Anthropic and Google revoked or blocked exposed keys, OpenAI refunded drawn credits and OpenCode says refunds are underway.
• Rotate any key you saved in Console at the provider and set provider-side spend limits, because Console budgets cannot cap a stolen raw key.