Category: Security | Reading time: 4 min
What Happened
On the night of Friday, 16 October 2026, an intruder reached a legacy system at OpenCode, the open-source AI coding agent, and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company's optional hosted service.
OpenCode emailed affected users on the morning of 17 October under the subject line "Action Required: Potential provider key breach." According to a screenshot of the email shared by security researcher Matt Johansen, it said OpenCode had "identified unauthorized access to a legacy system that we were in the process of decommissioning" and that provider keys saved in the workspace "may have been exposed." Later that day, OpenCode said on X that the breach was "related to a large scale distillation attack" and affected 1.4% of Console users, all of them a subset who had linked external providers. It said users who did not receive the email were not affected, and that it was working with Anthropic, OpenAI, and Google to remediate.
Co-founder Dax Raad clarified that the incident involved "the OpenCode Console, not OpenCode itself." Keys added in the local command-line and desktop apps stay on the user's machine and "never come to us," he wrote.
How the Providers Responded
The three model providers responded over the following two days:
- Anthropic: Lydia Hallie of the Claude Code team said on 17 October that Anthropic had revoked Claude API keys it believed were affected. - Google: Evan Otero of Google DeepMind said Google had blocked exposed Gemini API keys and was working with impacted customers. - OpenAI: On 19 October, OpenAI's Tibo said the company had worked with OpenCode to restore affected OpenAI API customers and refund credits drawn in the attack.
Raad said OpenCode had contacted every affected user and that refunds were underway. On 18 October he wrote that attackers had been "non stop trying to attack our systems for the past 48 hours," and that OpenCode was hardening its systems as a result. He also said frontier models "did quite a bit and then started refusing" during OpenCode's investigation, and that OpenCode had been approved on 17 October for OpenAI's Daybreak Blue tier for defensive security work, which he later called "critical."
What Users Report
Users on X and Reddit report charges they did not make, ranging from roughly $65 to about $3,000. The Hacker News cited reports of $281 on one user's OpenAI key and $168 on Anthropic, and another user putting losses at $1,700. These figures come from users, not OpenCode, which has said only that keys "may have been exposed."
OpenCode has not said what the legacy system was, how it was reached, when access began, how many keys it held, how many accounts 1.4% represents, or how the breach connects to distillation, the practice of harvesting a model's answers at scale to train a rival model.
Why It Matters
A provider key is a bearer credential. Whoever holds a copy can run billable requests against the owner's account until the provider revokes it. As The Hacker News noted, deleting the key from Console does not revoke it, and a Console budget cannot cap its use, because Console only sees traffic that passes through its own gateway.
That is the structural lesson for enterprises running agents. Hosted gateways and agent platforms are useful precisely because they hold long-lived credentials on behalf of many users and agents. That also makes them a concentration point. When one fails, the customer's ability to limit damage depends on controls the gateway does not own: per-tool keys, provider-side spend limits, and an independent record of which identity used which credential, when, and for what. The incident also shows a quieter dependency. A defender's own investigation can stall when the AI tools it relies on refuse mid-incident.
The Takeaway
Treat every place an agent credential is stored as part of your attack surface, including vendors' legacy systems you never see. Give each agent and tool its own scoped, short-lived identity, keep the authority to revoke it on your side, and keep your own record of every action it was allowed to take. When a third party reports that keys "may have been exposed," that record is how you prove what your agents did and did not do.
Source: The Hacker News: OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys | OpenCode on X | ctxsec: OpenCode Console breach timeline | On The Wire: OpenCode says a breach hit 1.4% of its Console users