OpenCode told some users on October 17 that the AI provider keys they had saved in its hosted Console may have been stolen. The company says 1.4% of Console users were hit, all of them people who had linked an outside provider such as OpenAI, Anthropic or Google. Several of those users found out from their billing dashboards before the email arrived.
The email, with the subject line "Action Required: Potential provider key breach," said an unauthorized party reached "a legacy system that we were in the process of decommissioning." The earliest possible exposure was 00:30 UTC on October 17. Co-founder Dax Raad drew a line right away: this was "the OpenCode Console, not OpenCode itself, those keys never come to us." The CLI and desktop app keep keys in a local SQLite database on your machine, and those weren't touched.
Everything else is still unknown. OpenCode hasn't said what the legacy system was, how the attacker got into it, how the keys were stored, or how many accounts sit behind that 1.4%. As of TechCrunch's report on October 19, the incident was still listed as ongoing.
What the Console does with your key
The Console is OpenCode's optional hosted layer for teams. You paste your Anthropic or OpenAI key into a workspace, and the Console routes requests through its own gateway so your teammates can use the models without ever seeing the key. The provider docs list Anthropic, OpenAI, Google, xAI, DeepSeek, Mistral and Groq in the catalog, cloud options like Bedrock and Vertex, and any custom endpoint you want. Budgets and usage reports work because every call passes through that gateway.
That design is fine right up until the gateway's key store leaks. A provider key is a bearer token. Whoever holds a copy can run billable requests until the provider revokes it. Deleting the key from the Console does nothing, and the Console's budget feature can't cap a stolen key either, since it only sees traffic that passes through OpenCode. The attacker's traffic went straight to the providers.
The docs don't say how keys are encrypted at rest. After this week, that is the first question I'd ask any vendor that wants to hold my credentials.
The charges people reported are small on their own and add up fast. The Hacker News collected a few. One developer saw about $281 on an OpenAI key and $168 on an Anthropic key. Another reported $1,700 in losses. A Reddit user posted $400 of unauthorized Anthropic usage. Another had around €200 of Google usage before Google suspended the project for "abusive activity consistent with hijacked resources."
One developer told TechCrunch: "I saw my Open AI, Anthropic, and Google AI spend alerts all fire off before going to bed wondering what was going on." The providers' spend alerts beat the vendor's disclosure by hours. If you run keys through any third party, your own spend alerts are the only detection you control.
The providers moved once they knew. Anthropic and Google blocked the keys they believed were exposed. OpenAI said it worked with OpenCode to restore access and refund API customers for credits used in the attack, per BleepingComputer. OpenCode says refunds are underway. Users with suspended Google projects still have to argue with Google support, which is its own tax.
The distillation claim has no evidence behind it yet
OpenCode's public post on X called the breach "related to a large-scale distillation attack." Distillation is the legitimate technique of training a smaller model on a bigger model's outputs. It becomes theft when the outputs are pulled through someone else's stolen key. Anthropic said in September that labs doing this reach its models through accounts made with stolen credit cards, stolen logins and harvested API keys.
So the theory holds together. A pile of fresh Claude and GPT keys is worth a lot to anyone who needs millions of model outputs and can't buy them under their own name. A few hundred dollars burned per key in one night matches that pattern better than it matches a crypto mining crew.
But OpenCode hasn't shown the link. It hasn't published what the traffic looked like, who ran it, or how the breach and the distillation campaign connect. Skeptics on X called the framing a stretch, and I'd put myself in that camp until a post-mortem shows up. Calling the attackers model thieves also pulls attention away from the customer's question: why was a system being decommissioned still holding live keys?
The defender's AI refused to help
Raad said attackers hammered OpenCode's systems nonstop for 48 hours, and the team kept AI agents running around the clock on defense. That worked until the models they were using hit the malicious code and tripped their own safety filters. His words for it were "a bit frustrating." OpenCode then got into OpenAI's Daybreak Blue program, which gives vetted users models that are less likely to refuse security work, and the investigation moved again.
Hugging Face hit the same wall in July when commercial models declined to analyze logs from an intrusion. Two incidents in three months where the defenders' tooling refused in the middle of an incident. The attackers had no such problem. David Sacks summed it up on X: "The guardrails backfired." A refusal filter that blocks the people reading the attack logs is a product defect, and it belongs to the model vendor to fix.
What I'd do this morning
If you ever pasted a provider key into the OpenCode Console, rotate it today whether or not you got the email. Rotation takes five minutes. Arguing with a billing department takes weeks.
- Revoke the key at the provider, not in the Console. A revoked Anthropic or OpenAI key returns HTTP 401, so test it.
- Update every CI secret and app that used the old key, including the Console workspace itself.
- Read your usage logs back to at least October 16.
- Set a spend limit on a dedicated workspace or project for each tool. Anthropic supports hard limits on non-default workspaces. Restrict Google keys to the Gemini API only.
Then think about the general shape. The convenience of a hosted gateway is that your team never handles keys. The cost is that one vendor's forgotten box holds everyone's keys at once. One key per tool, scoped and capped, limits the damage to one line item on one invoice. That's the only arrangement I'd accept for anything billed per token.
My prediction: when the post-mortem lands, the legacy system will turn out to be an earlier version of the gateway that was still reachable from the public internet, with keys stored in a form the attacker could read directly. Decommissioned means off. Unlinked from the dashboard is something else.
