On October 17, some OpenCode Console users opened an email that cited "unauthorized access to a legacy system that we were in the process of decommissioning." That notice was the first clear sign of the OpenCode breach, which may have exposed API keys that developers saved for OpenAI, Anthropic and Google models. The company says 1.4% of Console users were affected. The keys at issue can run paid, high-end AI models, so misuse turns directly into bills and data access.

The story is still developing, and OpenCode has not published a full report. Developers who use the hosted Console should check today whether anyone on their team received the email, and rotate saved provider keys whether or not they did.

What OpenCode disclosed and when

OpenCode is an open-source coding agent that runs in the terminal, and developers store third-party provider keys in its hosted Console. That storage widens the exposure beyond the local tool, according to AI TLDR.

The sequence, as reported so far, looks like this:

  • Overnight on October 16 and 17, the breach reportedly occurred, according to explainx.
  • On October 17, affected users received an email about unauthorized access.
  • At 18:08 UTC on October 17, OpenCode disclosed the incident publicly on X, according to DEV Community.

On X, the project's official account described the incident as "a large scale distillation attack that impacted 1.4% of OpenCode Console users." It said affected users were notified by email, and that anyone who did not receive one was not impacted.

Which API keys may be exposed

The keys at risk are the OpenAI, Anthropic, Google and other provider API keys linked to affected Console workspaces. The notice refers to third-party provider keys saved in a workspace, such as OpenAI and Anthropic, and says those keys may have been exposed.

The open-source CLI does not appear to be affected. OpenCode's notice concerns provider keys saved in the hosted Console, and it does not say the CLI itself was compromised, according to AI TLDR.

No total count of affected accounts has been published. A rate of 1.4% sounds small, but for a solo developer or a startup with a shared workspace, one exposed key is enough to cause real damage. The sources reviewed also do not say whether any provider will credit customers for unauthorized usage, which means the cost could fall on the account owner.

What attackers may have done with the keys

Reporting on what happened next is thin and mixed. CryptoBriefing reports, citing a single account, that once the attackers had the keys they ran repeated queries against high-end AI models. That detail has not been confirmed in an OpenCode statement.

Some users say they have seen usage charges they did not make. No dollar figure for unauthorized spending has been published, and OpenCode says it cannot yet confirm whether exposed keys were misused.

Treat an unexpected invoice as a warning sign, not a coincidence. A leaked key stays valid until someone revokes it, and every request made with it is billed to the account that owns it.

What OpenCode has not explained

  • How the attackers got in. OpenCode has not said, and it has not described how provider keys were stored. CryptoBriefing describes exploited vulnerabilities in a legacy system, but the sources reviewed include no technical write-up that confirms it.
  • The scope of the breach. Whether data beyond provider keys was taken is not confirmed. OpenCode says it cannot share more while remediation continues, according to explainx.
  • Misuse. Whether stolen keys were used, and how much unauthorized spending occurred, remains unknown.
  • The label. "Distillation attack" is OpenCode's term. In AI, distillation usually refers to training a smaller model on the outputs of a larger one, and no independent analysis in the reporting explains what the term means for this incident.
  • The provider response. OpenCode says it is working with Anthropic, OpenAI and Google. The sources do not confirm whether those companies have revoked or flagged any keys.

How to rotate exposed OpenAI and Anthropic keys

The steps below draw on guidance from several write-ups. Start with the people, then the keys, then the bills.

  • Ask every developer and team admin whether they received an OpenCode email. According to OpenCode, users who did not get one were not affected.
  • Revoke and reissue every provider key saved in a Console workspace. Do this on each provider's own dashboard, not only inside Console, as Developers Digest recommends.
  • Review usage and billing on every provider account from October 16 onward. Look for unfamiliar models, unexpected regions or sudden spikes in tokens.
  • Set provider-side spend caps so a stolen key cannot run up an unlimited bill.
  • Search code repositories, CI configuration and shell history for copies of the same key. A key can be copied to more places than the Console.
  • Rotate even if you were not emailed. Rotation is low-cost, and several sources recommend it for all users, according to Cyera.

Why stolen AI keys are becoming a bigger target

Cyera's analysis places the OpenCode breach in a wider pattern. It notes that in September, Anthropic described campaigns by China-based AI labs that pulled roughly 190 million exchanges from Claude, partly through "illegally harvested API keys."

That context matters because a coding agent concentrates keys in one place. A developer who once kept a key in a local config file may now have it stored in a hosted service, and a single breach there can expose keys from many accounts at once.

Credential theft at platform vendors is a recurring problem. USA 24 has reported that a compromised ConnectWise credential opened 173 Microsoft 365 tenants, a reminder that one stolen login at a vendor can reach many customers.

A separate credential campaign is also drawing federal attention. On October 6, the FBI and U.S. Secret Service issued a joint advisory on FortiBleed, warning that the main attackers were using compromised FortiGate environments as an initial access point for ransomware, according to Cybersecurity Dive. FortiBleed is a credential campaign rather than a new CVE, and it is a different incident from OpenCode. Edge devices keep drawing attacks, as the Ivanti VPN zero-day chain that USA 24 covered shows.

What to watch next

The most useful next signal is a full technical report from OpenCode that explains the entry point, how keys were stored and what data left the system. Watch whether Anthropic, OpenAI and Google confirm that they have revoked or flagged affected keys, and whether anyone publishes figures on unauthorized usage.

For US readers, the open question is whether regulators or customers will push for more detail. The sources reviewed show no US user counts and no US regulatory response so far. If the affected share rises above 1.4%, OpenCode will have to explain why its first estimate was low. Until then, the safest course is simple: rotate the key, check the bill and set a cap.