On the night of October 16, an attacker gained access to a legacy system of OpenCode, which, according to the company, may have led to exposure of API keys for third-party AI providers — OpenAI, Anthropic and Google — that users had stored in the OpenCode Console service. The company stated that 1.4% of Console users who had external providers connected were affected. All affected users have been notified and instructed to immediately revoke the compromised keys with the provider and replace them. The absolute number of impacted users has not been disclosed.
Timeline and scope of the incident
According to OpenCode, the unauthorized access occurred on the night of October 16. On the morning of October 17, the company sent an email to affected users with the subject line “Action Required: Potential provider key breach”. The same day, in an X post, the company clarified that those who did not receive the email were not affected.
OpenCode co-founder Dax Raad stressed that the incident concerns OpenCode Console specifically, not the OpenCode application itself. According to the documentation, local versions — the CLI and desktop app — store provider API keys in a local SQLite database on the user’s machine, and these keys “are never transmitted” to OpenCode’s servers.
Console, by contrast, operates as a hosted service: the user pastes the provider’s key into a workspace, and the Console gateway appends this key to requests when forwarding them to the provider, so team members can use models without seeing the key itself. It is precisely these keys stored on the Console side that were put at risk.
Important caveat: OpenCode uses the wording “keys may have been exposed” and has not confirmed that any key was actually copied or used by the attacker. The company has also not disclosed what the “legacy system” consisted of, how access was obtained, or how many keys it contained.
Open questions about the scope
The 1.4% figure comes from OpenCode itself, and the absolute number of users remains unknown. The stated scope of the incident covers only Console users with an external provider connected. However, in a GitHub discussion, one user claims that their key was revoked even though no third-party provider was connected in their workspace. This is a single unverified report that may be unrelated to this incident, but it leaves the exact boundaries of the compromise unclear.
Link to distillation and ongoing attacks
In its October 17 publication, OpenCode described the incident as “related to a large-scale distillation attack”. Distillation is the term AI providers use for campaigns that mass-extract model outputs in order to train competing systems. Anthropic has previously noted that such campaigns make use of networks of fake accounts, stolen payment details and stolen API keys.
However, OpenCode did not name a specific attacker or explain the technical connection between the Console breach and the alleged distillation campaign. This characterization should be treated as the company’s version of events rather than established attribution.
On October 18, Raad reported that attackers “have been continuously trying to breach systems for the past 48 hours”, adding that “the side effect is everything is becoming more secure”.
Reports of unauthorized charges
Several secondary sources relay user claims of financial losses. According to Dealroom, one user reported $281 in unauthorized OpenAI usage and $168 for Anthropic, while another estimated losses at $1,700. Notebookcheck relays Reddit user reports of $400 in Anthropic charges and around €200 for Google. These amounts have not been confirmed by the providers and remain user claims.
Practical recommendations
An API key is a bearer credential: anyone who has a copy can make billable requests on the owner’s behalf until the provider revokes the key. Deleting a key from Console is not the same as revoking it with the provider. Console budget limits will not protect you either, because Console controls only the requests that pass through its own gateway.
For users whose keys were stored in Console:
- Revoke the key in the provider’s dashboard and create a new one. Instructions are available from OpenAI, Anthropic, and Google.
- Update all applications and scripts that used the old key.
- Check your usage history and billing with the provider for requests you did not make, at least starting from October 16. OpenCode has not specified exactly when the unauthorized access began.
- Set spending limits or alerts with the provider and assign a separate key to each tool — this limits the damage from the compromise of a single key and simplifies auditing.
We have previously written about OpenAI-related security issues in the context of the October 2026 cyber threat overview.
The OpenCode Console incident illustrates a specific risk of architectures where a third-party service stores bearer credentials on behalf of the user: a compromise of a single intermediary can put keys for several providers at risk at once. The top priority right now is to rotate keys with the provider, not in Console. In the longer term, it is worth revisiting the practice of handing API keys to third-party services and moving to authentication models that do not require the intermediary to store secrets — for example, OAuth flows with limited scopes.
