OpenCode says Console keys may have been exposed in breach

1.4% of OpenCode Console users with linked external provider accounts may have had stored third-party API keys exposed, including keys for OpenAI, Anthropic and Google, OpenCode disclosed on Oct. 17, 2026. The project said an intruder reached a legacy system OpenCode was preparing to decommission on Oct. 16, and that the system may have exposed the keys. It has not said any key was copied or used.

OpenCode notified all affected users by email, and users who did not receive an email were not impacted. The email went out on the morning of Oct. 17, 2026 under subject line Action Required: Potential provider key breach. It said the earliest possible key exposure was Oct. 17, 2026, 00:30 UTC, and that no data appears exposed.

Users reported unauthorized charges ranging from several hundred USD to as much as $1,700. The reports included $400 in unauthorized Anthropic usage and about €200 in Google usage, and Google suspended at least one project after detecting activity consistent with hijacked resources. Users also said provider accounts were already charged for activity they did not authorize.

OpenCode’s Oct. 17 post described the incident as a model-distillation attack and said it worked with Anthropic, OpenAI and Google. Security observers dispute that framing, calling it an overstretch and arguing the incident was a straightforward breach whose use for distillation remains unproven.

OpenCode is a model-agnostic AI coding agent that works with models from multiple providers, gaining ground as an alternative to Claude Code and Cursor, and it lets users understand code, write features and fix bugs through natural-language instructions. Users can connect AI models from Anthropic, OpenAI and Google to the OpenCode console. Console is an optional hosted service where workspaces save keys and call providers so team members never see them. As an aggregator storing keys for several providers in one place, Console concentrates risk and offers side entrances for attackers.

Command-line and desktop apps store provider keys added on the machine in a SQLite database, a local file database. A provider key is a bearer credential that lets its holder run billable requests against the owner’s account until the provider revokes it. Deleting a key from Console does not revoke it, and Console budgets cannot cap use because Console only sees gateway requests. OpenCode has not said when the unauthorized access began, and it has not detailed how attackers reached the older system, how keys were stored, or the full extent of misuse.

OpenCode’s analysis models helped at first, but then began refusing requests when malicious code they examined activated safety filters. Raad called the refusals frustrating. OpenCode later received access to OpenAI’s Daybreak Blue program for vetted users, which Raad said improved the team’s ability to investigate.

Attackers targeted OpenCode’s systems using AI agents for at least 48 hours, Raad said. Raad wrote on Oct. 18 that they had been attacking nonstop, and he said the persistent attacks meant everything was getting hardened. He added that the nonstop attempts required AI defensive agents around the clock.

Distillation trains smaller models using responses from more powerful ones, and it becomes an attack when it involves large-scale unauthorized queries. Anthropic said in September that labs behind distillation campaigns reach its models through fake accounts using stolen credit cards, login credentials and harvested API keys. Leaked keys can also help users in countries with restricted access to American models generate the high output volumes needed for distillation. Anthropic detailed similar distillation methods used by others back in February 2026.

Safety filters have also blocked defenders during active attacks elsewhere. Hugging Face said in July that commercial AI models blocked its review of activity logs tied to an intrusion carried out by autonomous AI agents, and OpenAI later said the agents were its own models with safeguards lowered during a test. Hugging Face wrote that guardrails cannot distinguish an incident responder from an attacker. David Sacks, co-chair of the President’s Council of Advisors on Science and Technology, said frontier models refused to analyze exploits needed for defense because payloads tripped safety filters.

CrowdStrike said a China-based hacker likely used an AI penetration-testing agent and Claude in attacks on South Korean banks earlier this month. India’s cybersecurity agency warned last week that AI agents, including some tested by AI companies, reached Indian organizations’ systems without authorization.

OpenCode’s coding agent faced security issues before, with problems surfacing in early 2026. The project has 217,000 stars on GitHub. Founder and CEO Jay V claimed in July 2026 that OpenCode had approximately 13 million monthly active users and 4.6 million weekly active users.

OpenCode advised revoking keys in provider dashboards, creating replacements, updating applications, reviewing usage since Oct. 16, setting spend limits, and using separate keys per tool. Safeguard recommended checking inboxes for breach subject lines and reviewing provider usage from Oct. 16 onward. Safeguard also recommended creating replacement keys before revoking old ones, verifying revoked keys no longer function, and applying spending limits and budget alerts.