OpenCode Console Breach: Why Your AI Provider Keys May Be at Risk
If you saved your OpenAI, Anthropic or Google API key in a hosted tool, you are trusting that tool to protect one of the most valuable credentials you own. A recent incident at OpenCode shows what happens when that trust is tested.
What happened
OpenCode said an intruder reached a legacy system on the night of October 16 and may have exposed the third-party AI provider keys that some users had stored in OpenCode Console. Console is the company’s optional hosted service, where a workspace saves its own OpenAI, Anthropic or Google key so that team members can use the models without ever seeing the key. About 1.4% of Console users, all of whom had an outside provider linked, were affected, and OpenCode emailed them on October 17 under the subject “Action Required: Potential provider key breach.” Anyone who did not receive that email was not affected, according to the company.
What is not affected
OpenCode’s co-founder Dax Raad stressed that the breach involves the Console and not the OpenCode tool itself. The command-line and desktop apps store provider keys on the user’s own machine, and those keys never reach OpenCode’s servers, so only keys pasted into Console are at risk.
Why a leaked key is so dangerous
An API key is a bearer credential, which means that whoever holds a copy can run billable requests on the owner’s account until the provider revokes it. Deleting the key from Console does not make it safe, and a budget set inside Console cannot cap the damage either, because Console only sees requests that pass through its own gateway. The only real fix is to revoke the key at the provider.
Users report real losses
Some users say they have already paid for usage they never ran. According to Dealroom, one user reported $281 of unauthorized OpenAI usage and $168 on Anthropic, and another put his losses at $1,700. Notebookcheck cited further Reddit claims of about $400 on an Anthropic account and roughly €200 on Google. These are the users’ own accounts, though, and OpenCode’s wording is only that the keys “may have been exposed.” The company has not said that any key was actually copied or used.
A link to distillation attacks?
OpenCode called the incident ongoing, said it was working with Anthropic, OpenAI and Google, and described the breach as related to a large-scale distillation attack. That term refers to campaigns that pull huge numbers of answers from an AI model to train a rival one. Anthropic said in September that such campaigns often use networks of fake accounts built on stolen credit cards, stolen logins and harvested API keys, and criminal markets also resell stolen AI keys to run up bills. OpenCode has not named anyone or explained how the two are connected, nor has it said what the legacy system was, how it was reached, or how many keys it held. Raad added on October 18 that attackers had been trying to get in “non stop” for 48 hours, and that the company was hardening everything as a result.
What you should do
If you received the email, revoke the key in your provider’s own dashboard, create a new one and update every application and script that used the old key. Then review your usage and billing at the provider for requests you did not make, going back at least to October 16, since OpenCode has not said when the unauthorized access began. It is also wise to set a spend limit or alert at the provider and give each tool its own key, so that a copied key does less damage and its use is easier to trace.
Final thoughts
This incident is a reminder that any service holding your API keys becomes part of your attack surface. Stored keys are targets, and AI keys are especially attractive because they turn directly into money or into free access to powerful models. Prefer short-lived or tightly scoped keys where you can, set spending limits, and treat any breach notice as a reason to rotate immediately.
Comments