OpenCode Breach Exposes AI Keys of 1.4% of Console Users

The OpenCode breach exposed third-party AI provider keys saved by about 1.4% of OpenCode Console users. The company confirmed it on October 17 and blamed a “large scale distillation attack.” Keys for OpenAI and Anthropic were named. Affected users report unauthorized bills, including one claim of $400 on an Anthropic account. If you got OpenCode’s email, revoke those keys now.

Key takeaways

• OpenCode says 1.4% of Console users had stored provider keys exposed.
• One user reported $400 in unauthorized Anthropic charges; another about €200 on Google.
• In February, Anthropic disclosed 16 million distillation exchanges through about 24,000 fake accounts.

What happened in the OpenCode breach?

Attackers got into a legacy OpenCode system that the company was shutting down. From there, they could reach OpenAI, Anthropic and other provider keys that users had saved in their OpenCode Console workspaces. OpenCode says the breach hit about 1.4% of Console users and is tied to a “large scale distillation attack.”

The first public sign came from a customer email. Security researcher Matt Johansen posted a screenshot at about 15:30 UTC on October 17, writing: “Confirmed. OpenCode hacked. Keys stolen,” according to a timeline compiled on DEV Community.

OpenCode confirmed it on X at about 18:08 UTC. “We had a security breach last night related to a large scale distillation attack,” the company wrote. “The incident is ongoing so we cannot share more details at this point.”

What the email told customers

The subject line read “Action Required: Potential provider key breach.” It said OpenCode “identified unauthorized access to a legacy system that we were in the process of decommissioning.”

The key line: “Third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed.” OpenCode says it emailed everyone affected. If you got no email, it says you were not hit.

What is OpenCode Console, and why did it hold the keys?

OpenCode is a free, open-source AI coding agent that runs in the terminal, a desktop app or an IDE. Console is its hosted team layer. Teams connect model accounts they already pay for, and Console stores those keys so members can use the models without ever seeing them.

That convenience is the risk. OpenCode’s Console providers documentation says a workspace can link accounts users “already pay for,” including Anthropic, OpenAI and AWS Bedrock. A stored key stays live and bills its owner, whoever is using it.

The tool’s reach is wide. OfficeChai reported that OpenCode supports more than 75 model providers and has reportedly passed 150,000 GitHub stars. The team behind the SST serverless framework built it and launched it in June 2025.

One limit matters for CLI users. Keys added locally with the /connect command sit on your own machine, not in Console. OpenCode’s notice covers workspace keys and has not addressed local ones.

How much money did the stolen API keys cost users?

Nobody has a total yet. OpenCode has not released a dollar figure, a count of affected accounts or a number of stolen keys. User posts give a rough sense of scale: hundreds of dollars per account, not thousands so far. None of those figures has been independently confirmed.

Notebookcheck collected the reports. One user said they saw $400 in unauthorized charges on an Anthropic account. Another reported about €200 in Google usage, and Google suspended that project for what it called excessive abuse.

A third detail is telling. One commenter said usage alerts from OpenAI and Anthropic reached them before OpenCode’s breach notice did. In other words, the model providers’ billing systems spotted the abuse first.

Question	What we know	Status
Share of users hit	About 1.4% of OpenCode Console users	Confirmed by OpenCode
What was exposed	Third-party provider keys saved in workspaces (OpenAI, Anthropic named)	Confirmed by OpenCode
Entry point	A legacy system being decommissioned	Confirmed by OpenCode
Charges on victims’ accounts	$400 on Anthropic; about €200 on Google	User reports, unverified
Remediation partners	Anthropic, OpenAI and Google	Confirmed by OpenCode
Attacker, vector, duration	Not disclosed	Unknown
Refunds	No public policy from OpenCode or providers	Unknown

What is a distillation attack?

Distillation means training a cheaper model on the answers of a stronger one. A distillation attack does it without permission and usually at someone else’s expense. Stolen API keys are ideal: the attacker harvests frontier-model output, and the key’s owner pays the bill.

The scale is industrial. On February 23, Anthropic disclosed more than 16 million exchanges with Claude through about 24,000 fraudulent accounts, attributed to DeepSeek, Moonshot AI and MiniMax. “In one case, a single proxy network managed more than 20,000 fraudulent accounts simultaneously,” the company wrote.

The campaigns kept growing. Unite.AI reported that Anthropic’s October 12 update tallied more than 151 million exchanges attributed to Alibaba between May and July, from more than 3,500 accounts. We covered the policy side in our piece on the AI distillation advisory naming six Chinese firms.

Distillation data point	Figure	Source
Exchanges disclosed February 23	More than 16 million	Anthropic
Fraudulent accounts used	About 24,000	Anthropic
Exchanges attributed to Alibaba, May–July	More than 151 million	Anthropic, via Unite.AI
Drop in data harvested after new defenses	About 90% to 99%	Anthropic, via Unite.AI
Classifier false-positive rate	Below 0.1%	Anthropic, via Unite.AI

Why a coding tool makes a target

Here is our read, not OpenCode’s. Anthropic says its defenses cut harvested data by about 90% to 99%. Those defenses work by spotting fake accounts. A stolen key from a real, paying developer looks like a customer, not a fraud ring. Aggregators that store thousands of such keys become a shortcut around the filters.

Who is affected, and what should they do now?

Only OpenCode Console users who linked external provider accounts to a workspace are affected, and OpenCode says it emailed all of them. Anyone who got that email should treat every saved key as compromised. The fix takes minutes; every hour of delay only adds to the bill.

1. Revoke and replace every provider key saved in your Console workspace, in each provider’s own dashboard.
2. Update every app, script and CI secret that used the old keys, including the workspace itself.
3. Confirm the old keys are dead. A call to the provider’s models endpoint with an old key should fail with an authentication error.
4. Review usage logs back to at least October 16 for activity you don’t recognize.
5. Set hard spend limits and usage alerts on every provider account, if you haven’t already.
6. File a billing dispute with the provider for any charges you didn’t make, and keep screenshots.

Logins were rocky during the cleanup. Notebookcheck reported that some users saw “Unable to start social login” errors and that a few new OpenCode keys did not work at first.

Is the attack still going on?

Probably, based on what the team itself says. On the morning of October 18, OpenCode co-founder Dax Raad wrote that attackers had “been non stop trying to attack our systems for the past 48 hours.” OpenCode has not said the incident is contained.

Raad also said his “personal accounts are being attacked now too.” And he flagged an awkward problem. When his team used frontier models to investigate, the models “did quite a bit and then started refusing,” he wrote, according to OfficeChai.

The team later got access to “daybreak blue,” which OfficeChai identifies as a tier of OpenAI’s Daybreak program for vetted defenders. That is the safety trade-off in one sentence: the guardrails that slow attackers also slowed the people cleaning up after them.

Who wins and who loses from the OpenCode breach?

The biggest loser is the bring-your-own-key model behind many AI coding tools. Developers now have a concrete reason to doubt any third party that stores live, billable keys. The winners are the model labs’ own coding agents and security vendors selling secrets management.

Losers

• Affected developers. They carry the bills until someone agrees to refund them, and no one has promised to.
• OpenCode’s hosted business. The agent is free. Console is the part that turns users into a company, and Console is what failed.
• Multi-provider aggregators. Every tool that pools user keys now faces the same question from security teams: where are our keys, and who can reach them?

Winners

• First-party agents. Tools like Claude Code and Codex bill directly through the lab’s account, with no middleman storing keys. Our Claude Code vs Codex CLI cost comparison covers how those plans price out.
• Model providers, on balance. Their billing alerts caught abuse early. But they also wear the loss when distilled outputs train a rival model.
• Security vendors. Secrets rotation, agent identity and spend controls just got a fresh, vivid sales case.

The skeptical view

“Distillation attack” is a convenient label. It casts a faceless outside actor as the story. But the failure OpenCode admits is its own: a legacy system still online, still able to reach live customer keys. Without an attacker, a vector or a timeline, the label is a claim, not a finding.

Regulators are already pointing at this kind of weak spot. India’s CERT-In issued a critical advisory on October 16 after AI agents reached live systems at Indian firms. The advisory named exposed credentials and forgotten APIs as root causes and told firms to keep logs for at least 180 days. It is the same pattern we saw in the AWS Loom agent-takeover flaw.

What to watch next

OpenCode has not announced any dated follow-ups, and the providers have said nothing public about refunds. So the next week comes down to four signals. Each one changes who ends up paying for this breach.

• A postmortem. Watch for OpenCode naming the vector, the dates of access and the number of keys taken.
• Refund policy. Any statement from Anthropic, OpenAI or Google on charges from stolen keys sets a precedent for the whole tool ecosystem.
• Attribution. If a lab links the harvested output to a specific rival, the story moves from security to trade policy.
• Copycats. Other key-storing coding tools are the obvious next targets. Expect audits, and possibly more disclosures.

OpenCode breach FAQ

Was I affected by the OpenCode breach?

OpenCode says it emailed every affected user. If you did not receive an email, the company says you were not impacted. Only Console users with external provider keys saved in a workspace were hit.

Which API keys were exposed?

Third-party provider keys saved in OpenCode Console workspaces. OpenCode named OpenAI and Anthropic as examples and is working with Anthropic, OpenAI and Google on remediation.

Are OpenCode CLI users at risk?

OpenCode’s notice covers keys stored in Console. CLI keys added with /connect are stored locally on your machine, and OpenCode has not said they were affected.

Will I get a refund for unauthorized charges?

No refund policy has been announced by OpenCode or the providers. File a billing dispute with each provider and keep your usage records.

What is a distillation attack?

It is the unauthorized harvesting of a strong model’s outputs to train another model. Stolen keys let the attacker do it while the key owner pays.

Is this related to the earlier OpenCode vulnerability?

Reports say it appears unrelated to CVE-2026-22812, a remote-code-execution flaw that OpenCode patched in version 1.1.10 earlier in 2026.

The bottom line

The OpenCode breach is small in share and large in meaning. About 1.4% of Console users were hit, and the reported losses run in the hundreds of dollars. But it shows that a stored API key is a blank check, and distillers now know where those checks are kept.

Our verdict: rotate any key you have saved in a third-party AI tool, not just OpenCode, and cap spending on every provider account. Until OpenCode publishes a real postmortem, treat “distillation attack” as its explanation, not as the full story.

Sources

• DEV Community: OpenCode told 1.4% of Console users to revoke their OpenAI and Anthropic keys
• OfficeChai: OpenCode discloses security breach
• OfficeChai: Dax Raad on being blocked by AI cyber safeguards
• Notebookcheck: OpenCode confirms breach as users report charges
• OpenCode: Console providers documentation
• Anthropic: Detecting and preventing distillation attacks
• Unite.AI: Anthropic reports distillation defenses
• Deccan Chronicle: CERT-In issues critical alert on AI agents

Wealth Engine researches and drafts with AI tools and checks every figure against the sources above. How we report.