OpenCode breach may have exposed users' AI provider keys

OpenCode, the open-source coding agent, says an intruder got into a legacy system it was in the middle of shutting down, on the night of 16 October. What was at risk: the OpenAI, Anthropic or Google keys that teams had saved in OpenCode Console, its optional hosted service that lets team members use models without ever seeing the key.

What OpenCode said

On 17 October OpenCode emailed affected users with the subject “Action Required: Potential provider key breach” and told them to revoke and replace their keys. In a public post the same day it said the breach was “related to a large scale distillation attack” and hit 1.4% of Console users, all of them people with outside providers linked. If you didn't get an email, you weren't affected. It called the incident ongoing and said it was working with Anthropic, OpenAI and Google to fix it.

Keys added in the local OpenCode apps weren't involved, because those stay on your own machine. As co-founder Dax Raad put it, this was “the OpenCode Console, not OpenCode itself.” Distillation, for the record, means pulling a model's answers in huge volumes to train a rival model, and Anthropic has said those campaigns lean on fake accounts and harvested API keys, among other things. OpenCode hasn't said how the two connect, what the legacy system was, how it was reached or how many people 1.4% is.

The bills

Some users say they'd already been charged for usage they didn't run, by their own accounts anywhere from $168 to $1,700. Others reported $400 on an Anthropic account and around €200 of Google usage before their project was suspended. Those are users' claims. OpenCode itself only says the keys “may have been exposed”, not that any were used. One user later posted a follow-up email saying OpenCode had worked with OpenAI to revoke the exposed OpenAI keys, and that OpenAI had refunded any unauthorised usage.

The attackers weren't done, either. On 18 October Raad said they'd been “non stop trying to attack our systems for the past 48 hours”, adding that “a side effect is everything is getting hardened.”

Our take

A provider key is a bearer credential: whoever holds a copy can spend your money until you revoke it. Deleting it from a tool doesn't revoke it, and a tool's own budget can't cap usage that never goes through that tool. So give every tool its own key, set a hard spend limit or alert at the provider, and know exactly where to click to revoke a key fast. The fewer places your keys live, the fewer breach emails you'll be reading.