# OpenCode Console Breach May Expose OpenAI, Anthropic and Google API Keys

- URL: https://usa-24.com/opencode-breach-api-keys-rotate/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-18T07:13:23.279Z
- Updated: 2026-10-18T07:13:23.286Z
- Topics: AI Security, API Keys, Data Breach, OpenCode, Open Source Software

> OpenCode says attackers may have reached API keys that users saved for OpenAI, Anthropic and Google in its hosted Console, affecting 1.4% of users.

## Key takeaways

- OpenCode disclosed the breach on October 17, 2026, and says 1.4% of Console users were affected.
- The exposed keys are provider API keys for OpenAI, Anthropic and Google saved in hosted Console workspaces, and the open-source CLI does not appear to be affected.
- Some users report charges they did not make, but no total figure for unauthorized spending has been published.
- Users should revoke and reissue affected keys on each provider's own dashboard, then review billing from October 16 onward.
- OpenCode has not explained how attackers got in, and its 'distillation attack' label remains unexplained.

On October 17, some OpenCode Console users opened an email that cited "unauthorized access to a legacy system that we were in the process of decommissioning." That notice was the first clear sign of the OpenCode breach, which may have exposed API keys that developers saved for OpenAI, Anthropic and Google models. The company says 1.4% of Console users were affected. The keys at issue can run paid, high-end AI models, so misuse turns directly into bills and data access.

The story is still developing, and OpenCode has not published a full report. Developers who use the hosted Console should check today whether anyone on their team received the email, and rotate saved provider keys whether or not they did.

## What OpenCode disclosed and when

OpenCode is an [open-source coding agent that runs in the terminal](https://pasqualepillitteri.it/en/news/25135/opencode-hacked-api-keys-openai-anthropic-google-at-risk), and developers store third-party provider keys in its hosted Console. That storage widens the exposure beyond the local tool, according to [AI TLDR](https://ai-tldr.dev/releases/opencode-console-breach-provider-keys/).

The sequence, as reported so far, looks like this:

- Overnight on October 16 and 17, the breach reportedly occurred, according to [explainx](https://explainx.ai/blog/opencode-console-breach-stored-api-keys-distillation-attack-what-to-do-2026).
- On October 17, affected users received an email about unauthorized access.
- At 18:08 UTC on October 17, OpenCode disclosed the incident publicly on X, according to [DEV Community](https://dev.to/gabrielanhaia/opencode-told-14-of-console-users-to-revoke-their-openai-and-anthropic-keys-561).

On X, the project's official account described the incident as "a large scale distillation attack that impacted 1.4% of OpenCode Console users." It said affected users were notified by email, and that anyone who did not receive one was not impacted.

## Which API keys may be exposed

The keys at risk are the OpenAI, Anthropic, Google and other provider API keys linked to affected Console workspaces. The notice refers to third-party provider keys saved in a workspace, such as OpenAI and Anthropic, and says those keys may have been exposed.

The open-source CLI does not appear to be affected. OpenCode's notice concerns provider keys saved in the hosted Console, and it does not say the CLI itself was compromised, according to [AI TLDR](https://ai-tldr.dev/releases/opencode-console-breach-provider-keys/).

No total count of affected accounts has been published. A rate of 1.4% sounds small, but for a solo developer or a startup with a shared workspace, one exposed key is enough to cause real damage. The sources reviewed also do not say whether any provider will credit customers for unauthorized usage, which means the cost could fall on the account owner.

## What attackers may have done with the keys

Reporting on what happened next is thin and mixed. [CryptoBriefing](https://cryptobriefing.com/opencode-distillation-attack-api-key-breach/) reports, citing a single account, that once the attackers had the keys they ran repeated queries against high-end AI models. That detail has not been confirmed in an OpenCode statement.

Some users say they have seen usage charges they did not make. No dollar figure for unauthorized spending has been published, and OpenCode says it cannot yet confirm whether exposed keys were misused.

Treat an unexpected invoice as a warning sign, not a coincidence. A leaked key stays valid until someone revokes it, and every request made with it is billed to the account that owns it.

## What OpenCode has not explained

- How the attackers got in. OpenCode has not said, and it has not described how provider keys were stored. CryptoBriefing describes exploited vulnerabilities in a legacy system, but the sources reviewed include no technical write-up that confirms it.
- The scope of the breach. Whether data beyond provider keys was taken is not confirmed. OpenCode says it cannot share more while remediation continues, according to [explainx](https://explainx.ai/blog/opencode-console-breach-stored-api-keys-distillation-attack-what-to-do-2026).
- Misuse. Whether stolen keys were used, and how much unauthorized spending occurred, remains unknown.
- The label. "Distillation attack" is OpenCode's term. In AI, distillation usually refers to training a smaller model on the outputs of a larger one, and no independent analysis in the reporting explains what the term means for this incident.
- The provider response. OpenCode says it is working with Anthropic, OpenAI and Google. The sources do not confirm whether those companies have revoked or flagged any keys.

## How to rotate exposed OpenAI and Anthropic keys

The steps below draw on guidance from several write-ups. Start with the people, then the keys, then the bills.

- Ask every developer and team admin whether they received an OpenCode email. According to OpenCode, users who did not get one were not affected.
- Revoke and reissue every provider key saved in a Console workspace. Do this on each provider's own dashboard, not only inside Console, as [Developers Digest](https://www.developersdigest.tech/blog/opencode-console-breach-rotate-provider-keys-2026) recommends.
- Review usage and billing on every provider account from October 16 onward. Look for unfamiliar models, unexpected regions or sudden spikes in tokens.
- Set provider-side spend caps so a stolen key cannot run up an unlimited bill.
- Search code repositories, CI configuration and shell history for copies of the same key. A key can be copied to more places than the Console.
- Rotate even if you were not emailed. Rotation is low-cost, and several sources recommend it for all users, according to [Cyera](https://www.cyera.com/blog/opencode-breach-what-happened-and-how-to-rotate-exposed-ai-api-keys).

## Why stolen AI keys are becoming a bigger target

Cyera's analysis places the OpenCode breach in a wider pattern. It notes that in September, Anthropic described campaigns by China-based AI labs that pulled roughly 190 million exchanges from Claude, partly through "illegally harvested API keys."

That context matters because a coding agent concentrates keys in one place. A developer who once kept a key in a local config file may now have it stored in a hosted service, and a single breach there can expose keys from many accounts at once.

Credential theft at platform vendors is a recurring problem. USA 24 has reported that a [compromised ConnectWise credential opened 173 Microsoft 365 tenants](https://usa-24.com/connectwise-cloud-backup-breach/), a reminder that one stolen login at a vendor can reach many customers.

A separate credential campaign is also drawing federal attention. On October 6, the FBI and U.S. Secret Service issued a joint advisory on FortiBleed, warning that the main attackers were using compromised FortiGate environments as an initial access point for ransomware, according to [Cybersecurity Dive](https://www.cybersecuritydive.com/news/fbi-fortibleed-credential-harvesting-attacks/832366/). FortiBleed is a credential campaign rather than a new CVE, and it is a different incident from OpenCode. Edge devices keep drawing attacks, as the [Ivanti VPN zero-day chain](https://usa-24.com/ivanti-connect-secure-zero-day-root-access/) that USA 24 covered shows.

## What to watch next

The most useful next signal is a full technical report from OpenCode that explains the entry point, how keys were stored and what data left the system. Watch whether Anthropic, OpenAI and Google confirm that they have revoked or flagged affected keys, and whether anyone publishes figures on unauthorized usage.

For US readers, the open question is whether regulators or customers will push for more detail. The sources reviewed show no US user counts and no US regulatory response so far. If the affected share rises above 1.4%, OpenCode will have to explain why its first estimate was low. Until then, the safest course is simple: rotate the key, check the bill and set a cap.

## Frequently asked questions

### Was my OpenCode account affected by the breach?

OpenCode says affected users were notified by email, and that people who did not receive one were not impacted. No total count of affected accounts has been published, so teams that saved OpenAI, Anthropic or Google keys in a Console workspace should rotate them anyway. Checking your inbox and your provider billing pages takes only a few minutes.

### Does the breach affect the open-source OpenCode CLI?

Reporting says the open-source CLI does not appear to be affected. OpenCode's notice concerns provider keys saved in the hosted Console, and it does not say the CLI was compromised. OpenCode has not published a full report, so that conclusion may change.

### How do I rotate an exposed OpenAI or Anthropic key?

Revoke the key on the provider's own dashboard, create a new one and update every app, repository and CI configuration that uses it. Then review usage from October 16 onward and set provider-side spend caps. Search code and shell history for other copies of the key before you consider the job done.

### Have the stolen keys been used for unauthorized queries?

That has not been confirmed. One account reported by CryptoBriefing says attackers ran repeated queries against high-end models, and some users report charges they did not make. OpenCode says it cannot yet confirm whether exposed keys were misused, and no dollar figure has been published.

## Sources

1. [OpenCode Breach: What Happened and How to Rotate Exposed AI API Keys](https://www.cyera.com/blog/opencode-breach-what-happened-and-how-to-rotate-exposed-ai-api-keys)
2. [OpenCode hacked, API keys for OpenAI, Anthropic and Google at risk](https://pasqualepillitteri.it/en/news/25135/opencode-hacked-api-keys-openai-anthropic-google-at-risk)
3. [OpenCode Told 1.4% of Console Users to Revoke Their OpenAI and Anthropic Keys](https://dev.to/gabrielanhaia/opencode-told-14-of-console-users-to-revoke-their-openai-and-anthropic-keys-561)
4. [OpenCode discloses distillation attack that hit 1.4% of Console users](https://cryptobriefing.com/opencode-distillation-attack-api-key-breach/)
5. [OpenCode Hacked: What the Console Breach Means for Your API Keys](https://www.developersdigest.tech/blog/opencode-console-breach-rotate-provider-keys-2026)
6. [OpenCode Console breach — users told to rotate OpenAI and Anthropic keys](https://ai-tldr.dev/releases/opencode-console-breach-provider-keys/)
7. [OpenCode Console Breach: Rotate Your API Keys Now (1.4%)](https://explainx.ai/blog/opencode-console-breach-stored-api-keys-distillation-attack-what-to-do-2026)
8. [FBI warns that FortiBleed credential-harvesting attacks are locking out firewall users](https://www.cybersecuritydive.com/news/fbi-fortibleed-credential-harvesting-attacks/832366/)