OpenCode Discloses Console Breach, Warns of Exposed Provider Keys
OpenCode, the popular open-source terminal coding agent built by Anomaly Innovations (formerly SST), disclosed that an intruder reached a legacy backend system on the night of October 16, 2026, potentially exposing third-party AI provider API keys that users had saved in OpenCode Console — the project's optional hosted workspace service. The company said the incident affected 1.4% of Console users and described it as tied to a "large-scale distillation attack," a technique in which an AI model is queried at volume so its outputs can be harvested to train a competing system. OpenCode notified every identified victim by email the following morning and said it is working with Anthropic, OpenAI, and Google to remediate the incident.
Incident Details
| Attribute | Value |
|---|---|
| Target | OpenCode Console (hosted workspace service) |
| Intrusion date | Night of October 16, 2026 |
| Public disclosure | October 17, 2026, via X and customer email |
| Attack type | Described by OpenCode as a "large-scale distillation attack" |
| Scope | 1.4% of Console users with linked external providers |
| Providers affected | OpenAI, Anthropic, Google |
| Not affected | Keys stored locally in the CLI/desktop app (SQLite) |
| Company | Anomaly Innovations (formerly SST), maker of OpenCode |
| Status | Under investigation; no full technical post-mortem released |
What Console Is — and Why Keys Lived There
OpenCode Console is the project's optional hosted service, separate from the open-source CLI and desktop agent that most developers run locally. A team workspace in Console can save its own OpenAI, Anthropic, or Google API key so that team members can use the underlying models without ever seeing the raw credential themselves — Console holds the key and proxies the calls. OpenCode co-founder Dax Raad was quick to draw a distinction on X, clarifying that "the OpenCode Console, not OpenCode itself" was breached, and that keys stored locally by the CLI or desktop app — in a local SQLite database — "never come to us" and were not part of the exposure.
What Happened
- Unauthorized access to a legacy system. The breach notification email sent to affected customers described the compromised system as one that was "in the process of decommissioning." OpenCode has not disclosed how the intruder reached it, what vulnerability (if any) was exploited, or how long the attacker had access before detection.
- Distillation-style abuse. OpenCode characterized the activity as a large-scale distillation attack — bulk querying of high-end models using the stolen keys, likely to harvest outputs for training a separate model. The company has not confirmed the specific models targeted, query volumes, or duration of the activity.
- Public disclosure and notification. OpenCode posted to X at 18:08 UTC on October 17 stating: "We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users. We have notified them all this morning via email." The notification email carried the subject line "Action Required: Potential provider key breach."
- Continued attacker activity. Multiple outlets reported that attackers continued attempting to breach OpenCode systems into October 18, suggesting the incident was not a single contained event.
Who Was Affected
Only Console customers who had linked an external AI provider key to their workspace were in scope — users relying solely on OpenCode's own hosted models, or running the CLI/desktop app with locally stored keys, were not affected. OpenCode said it emailed every identified victim and that anyone who did not receive a notification was not impacted. Notably, co-founder Dax Raad said his own personal accounts were also targeted in the attack, underscoring that the exposure was not limited to a narrow set of low-value test keys.
Financial Impact
Because provider API keys function as bearer credentials — anyone holding a copy can bill the owner's account until the key is revoked — several affected users reported real monetary losses once attackers began running queries against their stolen credentials:
- One user reported $281 in unauthorized OpenAI charges and $168 in Anthropic charges on the same account.
- Another reported more than $700 in losses.
- A third reported roughly $1,700 in unauthorized usage.
- Additional Reddit reports cited $400 in unauthorized Anthropic usage and roughly €200 in Google Cloud usage before a project was suspended.
OpenCode has been careful in its wording throughout, stating that keys "may have been exposed" and that it cannot yet confirm which — or whether any — were actually misused, even as individual users reported drained balances consistent with abuse.
Impact Assessment
| Impact Area | Description |
|---|---|
| Credential exposure | OpenAI, Anthropic, and Google API keys linked to affected Console workspaces may have been copied by the intruder |
| Financial exposure | Provider keys are bearer tokens; victims reported hundreds to over a thousand dollars in unauthorized model usage |
| Scope confirmation | OpenCode has not disclosed the root cause, intrusion vector, or total number of keys/users behind the 1.4% figure |
| Trust and transparency | No full technical post-mortem has been released; OpenCode has declined to share targeted models, query counts, or attack duration |
| Downstream risk | Any application or pipeline still referencing an exposed key remains vulnerable to billing abuse until the key is explicitly revoked at the provider |
| Local tooling | CLI/desktop users storing keys locally (SQLite) were not affected — exposure was isolated to the hosted Console service |
Recommendations
For OpenCode Console Users
- Revoke every API key that was ever linked to an OpenCode Console workspace, directly in the OpenAI, Anthropic, and Google provider dashboards — not through OpenCode's interface, since deleting a key from Console does not revoke it at the provider.
- Issue replacement credentials and update every application, pipeline, or CI job that referenced the old key before rotating it, to avoid breaking production workflows.
- Review provider billing and usage logs from October 16 onward for unfamiliar models, unusual query volumes, or activity at odd hours tied to your account.
- Reset your OpenCode account password and regenerate any Console API keys as a precaution, even if you did not receive a breach notification email.
For Security and Platform Teams
- Treat third-party SaaS key vaults as a supply-chain risk. Any hosted service that stores your provider credentials to proxy API calls is a single point of failure for every linked account.
- Scope keys tightly and set hard spend limits. Use per-project or per-tool API keys with provider-side budget caps and usage alerts so a leaked credential has a bounded blast radius rather than an open-ended bill.
- Audit which internal tools hold externally stored provider keys and build a rotation runbook now, rather than during the next incident.
For AI Provider Platforms
- Make emergency key revocation and usage-anomaly detection fast and self-service. OpenAI, Anthropic, and Google were all drawn into remediation after the fact; faster automated anomaly flags on sudden query-volume spikes could limit financial damage before a user notices a drained balance.
Key Takeaways
- OpenCode disclosed on October 17, 2026 that an intruder accessed a legacy Console system the night before, potentially exposing stored OpenAI, Anthropic, and Google API keys.
- The company characterized the activity as a "large-scale distillation attack" affecting 1.4% of Console users who had linked external providers — locally stored CLI/desktop keys were not affected.
- Several affected users reported real financial losses, with unauthorized usage ranging from roughly $168 to over $1,700 on individual provider accounts.
- OpenCode has disclosed limited technical detail: no root cause, intrusion vector, or full accounting of affected users has been published as of this writing.
- Provider API keys are bearer credentials — deleting them from a third-party console does not revoke them; affected users must revoke and rotate directly through each provider's own dashboard.
- The incident is a reminder that any hosted tool proxying your AI provider keys inherits that provider's blast radius — audit which services hold your keys before an incident forces the question.