OpenCode says an intruder got into a legacy system on the night of October 16. Provider keys saved in its hosted Console may have been exposed, and about 1.4% of Console users are affected.
If you saved an OpenAI, Anthropic, or Google key inside OpenCode Console, check your inbox before you do anything else. OpenCode has confirmed that someone broke into an older internal system on the night of October 16. The company says the provider keys that users stored in Console may have been exposed.
The company is careful with its wording. It says the keys “may have been exposed.” It has not said that any key was actually copied or misused.
What is OpenCode Console, and what was at stake?
Console is OpenCode’s optional hosted service. A team saves its own OpenAI, Anthropic, or Google key in a shared workspace. Console then uses that key to call the provider on the team’s behalf, so colleagues can work with the models without ever seeing the key itself.
That convenience is exactly what made the stored keys valuable. They sat in one place, and the breach reached the system that held them.
Who is affected?
OpenCode says the affected group is 1.4% of Console users, and every one of them has an outside provider key linked. The company emailed them on the morning of October 17 with the subject line “Action Required: Potential provider key breach.”
In a later post on X, OpenCode added that anyone who did not receive the email was not affected. The company has not said how many users that 1.4% represents.
Are the OpenCode CLI and desktop apps affected?
No, according to the company. Keys added in the OpenCode command-line and desktop apps are kept in a local SQLite database on the user’s own machine.
Co-founder Dax Raad stressed on X that the breach involves the Console, “not OpenCode itself,” and that keys stored locally never reach the company’s servers. The risk applies only to keys pasted into Console.
Why a leaked provider key is a serious problem
A provider key works like a bearer credential. Whoever holds a copy can send billable requests to the owner’s account until the provider cancels the key.
Two details catch people out:
- Deleting the key from Console does not revoke it. The key stays live at the provider.
- A Console budget will not cap misuse. Console only sees traffic that passes through its own gateway. Requests made directly with a copied key never touch it.
What you should do right now
If you saved a key in a Console workspace, follow these steps. They come from OpenCode’s email and the providers’ own guidance.
- Revoke the key at the provider and create a new one. Use the dashboard of the provider concerned. Each has published instructions: OpenAI, Anthropic, and Google.
- Replace the old key everywhere. Update every application, script, and workspace that used it.
- Audit your usage and billing. Look for requests you did not make, going back to at least October 16. OpenCode has not said when the unauthorized access began, so a wider window is safer.
- Add guardrails. Set a spend limit or usage alert at the provider, and give each tool its own key. A copied key then does less damage, and it is easier to trace.
Some users report unexpected charges
A few users say they have already paid for usage they never ran. Dealroom reported that Colin Parsons said on X that his OpenAI key was used for $281 and his Anthropic key for $168. It also reported that Preston Zeller put his losses at $1,700.
Notebookcheck cited a Reddit user who claimed $400 of unauthorized Anthropic usage. Another user described about €200 of Google usage, after which the project was suspended.
These figures are the users’ own claims about their own accounts. They have not been independently verified, and OpenCode has not confirmed that any key was copied or used.
What OpenCode has said, and what it hasn’t
OpenCode’s October 17 post called the incident ongoing. It said the company is working with Anthropic, OpenAI, and Google to resolve it, and it described the breach as “related to a large-scale distillation attack.”
Several questions remain unanswered. The company has not named anyone responsible, or explained how the breach connects to a distillation attack. It has not said what the legacy system was or how it was reached. It has also not disclosed how many keys it held.
Why the distillation link matters
Distillation is the term AI providers use for campaigns that collect a model’s answers in huge numbers to train a rival model. In September, Anthropic said the labs behind such campaigns reach its models through networks of fake accounts built with stolen credit cards, login credentials, and harvested API keys.
Stolen keys have other uses as well. Criminal markets resell AI tokens and keys and use them to run up bills on other people’s accounts.
OpenCode has not tied this breach to any specific actor, so readers should not assume more than the company has stated.
The attack is still going on
On October 18, Raad wrote on X that attackers had been trying to get into OpenCode’s systems “non stop” for the previous 48 hours. He added that the pressure was leading to a hardening of the company’s defences.
The bottom line
If you did not get the October 17 email, OpenCode says you were not affected. If you did, treat the key as compromised. Revoke it at the provider, replace it, and check your billing history. Waiting for confirmation of misuse costs real money, while rotating a key takes minutes.
FAQ
What happened at OpenCode?
An intruder reached a legacy system on the night of October 16 and may have exposed provider API keys saved in OpenCode Console.
How many users were affected?
OpenCode says 1.4% of Console users, all of whom had an outside provider key linked. It has not given an absolute number.
How do I know if my key was exposed?
Affected users received an email on October 17 titled “Action Required: Potential provider key breach.” OpenCode says anyone who did not get it was not affected.
Are keys stored in the OpenCode CLI or desktop app at risk?
OpenCode says no. Those keys stay in a local database on the user’s machine.
Is deleting the key from Console enough?
No. You must revoke the key in the provider’s own dashboard.
