OpenCode got breached, and its users' AI keys started running up bills

The email subject line was "Action Required: Potential provider key breach." If you are a developer who pasted your OpenAI, Anthropic or Google API key into OpenCode's hosted Console, that is roughly the last thing you want to read on a Saturday morning. For some people it arrived after the spend alerts did.

OpenCode is one of the more popular open source AI coding agents, the kind of tool that sits in your terminal and calls a frontier model on your behalf. Its makers also run Console, an optional hosted service where a team can store a provider key in a shared workspace so everyone can use the models without seeing the credential. That convenience is what got hit.

What OpenCode has said

The company's public account is short. Its post on X, as quoted by StepSecurity and IBTimes Singapore, reads in part: "We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users." It said affected users had been emailed, that anyone who did not get an email was not affected, and that it was working with Anthropic, OpenAI and Google to remediate. "The incident is ongoing so we cannot share more details at this point," the post said.

According to IBTimes Singapore, the intruder reached a legacy system on the night of Oct. 16 and the notification emails went out the next morning. The company has not said how many people 1.4% is, how many keys sat on that system, how the attacker got in, or when the access started. StepSecurity, which published a response guide, notes there is no root cause yet.

Co-founder Dax Raad was quick to draw a line around the damage. In a reply quoted by IBTimes Singapore he wrote: "note this is the OpenCode Console, not OpenCode itself; those keys never come to us." Keys you add directly to the OpenCode command-line or desktop app stay on your machine, in a local SQLite database. Only the keys people pasted into the hosted Console were in play.

That distinction is real, and it is also a little beside the point if you were one of the people who used Console. The whole pitch of a shared key vault is that it holds the secret so your team doesn't have to. When it leaks, everyone who trusted it leaks with it.

The bills

An API key is a bearer credential. Whoever holds a copy can make billable requests until the provider kills it, and deleting the key from OpenCode's dashboard does nothing to stop that. IBTimes Singapore, citing Dealroom, reported that one developer, Colin Parsons, said on X that his OpenAI key was used for $281 and his Anthropic key for $168. Another, Preston Zeller, put his losses at $1,700. Notebookcheck reported Reddit users describing about $400 in unauthorized Anthropic usage and around 200 euros on Google, with one Google project suspended.

OpenCode itself has not said any key was copied or used. The providers moved anyway. Lydia Hallie, a member of technical staff at Anthropic, said the company had worked with OpenCode and revoked Claude API keys believed to be affected, adding: "If you saved a key in OpenCode and want to be extra careful, please create a new one!"

Now the odd part: the phrase "distillation attack." Distillation is the practice of training a cheaper model on the outputs of a more expensive one. It is the thing the big labs accuse rivals of doing when they see huge volumes of suspicious queries. A stash of other people's prepaid API keys is exactly what you would want if you planned to pull millions of answers out of Claude or GPT without paying for them, or without your own account getting flagged and banned. Nobody has confirmed that is what happened here. OpenCode has not explained how the breach connects to distillation, and IBTimes Singapore points that out directly. But if the label is right, the victims' billing accounts were the fuel.

The attackers also do not appear to be done. Raad wrote on Oct. 18: "they've been non stop trying to attack our systems for the past 48 hours, a side effect is everything is getting hardened but damn we basically need agents going 24/7, because that's what they have."

Read that last line twice. A small open source team is describing an adversary that never sleeps because it isn't a person, and concluding that the only answer is to run machines of its own. That is where security for AI tooling is heading: automated attackers against automated defenders, with your credit card in the middle.

If you used OpenCode Console with a linked provider, the advice from every source is the same. Revoke the key at the provider, not in OpenCode. Make a new one. Then open your usage dashboard and look for requests you didn't make. StepSecurity also suggests checking developer machines for OpenCode's local auth file to see which providers were ever linked, since teams rarely keep a list of which coding agents their engineers have installed.

The broader lesson is older than any of this. A place that stores lots of keys is a target. AI coding agents made it normal to hand third-party tools credentials that can spend real money in seconds. This week some of those tools found out what a vault is worth to someone else.

Sources: IBTimes Singapore: OpenCode breach may have exposed OpenAI, Anthropic and Google API keys, StepSecurity: OpenCode security breach, OpenCode on X, The Hacker News: OpenCode Console breach may have exposed OpenAI, Anthropic, and Google API keys.