OpenCode Says Console Breach May Have Exposed 1.4% of Users’ API Keys

OpenCode Says Console Breach May Have Exposed 1.4% of Users’ API Keys

OpenCode, maker of a popular open-source coding agent, has confirmed a breach of one of its legacy systems that may have exposed OpenAI, Anthropic and Google API keys saved by 1.4% of OpenCode Console users. The company is telling those users to revoke their keys with the providers immediately, and some are already reporting unwanted charges, one of them $1,700.

The breach happened overnight between October 16 and 17, 2026. On the morning of October 17, OpenCode emailed affected users under the subject line “Action Required: Potential provider key breach.” That evening it published a statement on X: https://twitter.com/opencode/status/2111519637049319818

The breach hit only the hosted Console, not OpenCode itself

The leak concerns only OpenCode Console, an optional hosted service. It does not affect the OpenCode tool that runs locally on a developer’s machine. Console works as a gateway: a team stores its own OpenAI, Anthropic or Google key in it, and the service sends requests to the provider on behalf of team members, who never see the key themselves.

In its email to users, OpenCode said it detected unauthorized access to a legacy system the company was already in the process of shutting down. Provider keys stored in Console workspaces may have been exposed. The company did not say that any key was copied or used.

OpenCode co-founder Dax Raad said on X that the incident concerned “the OpenCode Console, not OpenCode itself”. Keys added in the terminal and desktop versions are stored locally in a SQLite database on the user’s machine and, according to Raad, “never come to us.”

The affected group is 1.4% of Console users, meaning people who connected an outside model provider to the service. OpenCode did not say how many accounts that is or how many keys were in the compromised system. The company says anyone who did not receive the email is not affected.

Deleting a key in Console does nothing; revoke it with the provider

An API key is a bearer credential: anyone holding a copy can run paid requests on the owner’s account until the provider revokes it. Deleting a key in the OpenCode Console dashboard does not revoke it at OpenAI, Anthropic or Google. A spending limit set in Console does not help either, because Console sees only requests passing through its own gateway, not those sent directly to the provider with a stolen key.

Based on OpenCode’s email and the providers’ own guidance, people who saved a key in Console should do the following, in this order:

1. Revoke the key in the provider’s dashboard (OpenAI, Anthropic or Google) and generate a new one.
2. Update every application and script that used the old key.
3. Review usage and billing at the provider for requests the user did not make, going back to at least October 16. OpenCode did not say when the unauthorized access began.
4. Set a spending limit or alert at the provider and give each tool its own key, so a copied key does less damage and is easier to trace.

Share your AI tool, news or event

Tell our editorial team about your project. Include a short description, the relevant links and your contact information.

Submit to AIPORT

Users report unauthorized charges from $168 to $1,700

Some users say they have already paid for usage they did not generate. According to Dealroom, Colin Parsons wrote on X that his OpenAI key was used for $281 and his Anthropic key for $168, while Preston Zeller estimated his losses at $1,700. Notebookcheck cited a Reddit user who reported $400 in unauthorized usage on an Anthropic account, and a second who reported about 200 euros at Google, after which that user’s project was suspended.

The figures are accounts from the users themselves, not data confirmed by OpenCode. Reddit posts also mention expired OpenCode service keys and login errors with Google or GitHub, which OpenCode attributes to ongoing hardening of its systems.

Analysis

The story shows something I often forget when testing new AI tools: every place I paste an API key becomes a new point of failure. OpenCode did nothing exotic here. It stored keys because that is how the service works, and an old system that was supposed to be shut down was shut down too late. That is exactly what breaches look like at ordinary companies.

I have doubts about the communication. OpenCode called the incident a distillation attack before it called it a leak of customer keys. For model providers, distillation is a convenient, ominous-sounding word. For a developer with a $1,700 bill, it is plain credential theft. I would like the company to explain what it actually knows: how the intruder got in, how many keys they had, and what supports the conclusion that this is distillation rather than ordinary resale of tokens on a black market.

At the same time, I credit the speed. An email to affected users the next morning and a public statement the same day beat the industry standard. The open question is whether that is enough for teams to trust hosted gateways like this with their keys again.

OpenCode ties the breach to a distillation attack but does not explain the link

In its statement on X, OpenCode said the incident is “related to a large scale distillation attack.” It called the attack ongoing and said it is working with Anthropic, OpenAI and Google on remediation. The company did not name a culprit, describe what the compromised system was, say how the intruder reached it, or explain how stolen keys would be used for distillation.

In model-provider jargon, distillation means campaigns that mass-harvest a model’s responses to train a competing one. In a report dated September 10, 2026, Anthropic described labs running such campaigns through networks of fake accounts built on stolen payment cards, stolen login credentials and hijacked API keys. According to the same report, Anthropic dismantled campaigns by seven Chinese labs that generated about 190 million exchanges with Claude in total. In an earlier post dated February 23, 2026, the company described three labs, more than 16 million exchanges and about 24,000 fake accounts.

A stolen key has other uses. Criminal markets resell access to AI models and use other people’s keys to run up bills, which Anthropic also wrote about in its September report. That is why part of the industry disputes OpenCode’s label. According to Startup Fortune, researcher Nathan Lambert wrote that the public should know whether this is distillation in the sense of training models or some other use of illegally obtained tokens. Publicly available information does not indicate the former.

Raad says attacks continued nonstop for 48 hours

On October 18, the day after the incident was disclosed, Raad wrote on X that attackers were still trying to break into OpenCode’s systems. According to him, they were “non stop trying to attack our systems for the past 48 hours,” and a side effect is that the entire infrastructure is being hardened.

Raad also said his personal accounts had come under attack. OpenCode is developed by Anomaly Innovations, previously known as the team behind the SST framework. The tool supports models from more than 75 providers, and users bring their own keys, which makes it a natural target for anyone seeking legitimate-looking access to paid models.

What is known and not known as of October 20:

• Confirmed by OpenCode: a breach of a system being shut down, 1.4% of Console users with an outside provider connected, notification by email, and cooperation with Anthropic, OpenAI and Google.
• User reports, not confirmed by the company: unauthorized usage of roughly $168 to $1,700, and the suspension of a Google project after a limit was exceeded.
• Undisclosed: the number of affected accounts and keys, how the breach happened, when access began, the attacker’s identity, and evidence of a link to distillation.

Sources and methodology

• OpenCode statement on X, October 17, 2026
• Dax Raad post on X, October 17, 2026
• Dax Raad post on X, October 18, 2026
• The Hacker News, October 19, 2026
• Anthropic, post on distillation attacks, February 23, 2026
• Anthropic report of September 10, 2026, as cited in the original; no link was provided
• User loss reports via Dealroom and Notebookcheck; Nathan Lambert’s comment via Startup Fortune

Quotes from OpenCode and Dax Raad were verified against the original English-language source material.

Analysis and editorial responsibility: Piotr Wolniewicz, Editor-in-Chief, AIPORT. Original Polish reporting: Piotr Wolniewicz (aiport.pl).

This article was originally published in Polish on aiport.pl on October 20, 2026.
https://aiport.pl/co-nowego-w-ai/wlamanie-do-opencode-console-klucze-api-do-openai-anthropic-i-google-14-proc-uzytkownikow-mogly-wyciec-programisci-zglaszaja-rachunki-do-1700-dolarow/