- Published on
OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys
- Authors
- Name
- DeepHorus
An intruder reached a legacy system at OpenCode on the night of October 16, potentially exposing the third-party AI provider keys that users had saved in OpenCode Console. The company said the affected group is 1.4 percent of Console users, all of whom had an outside provider linked to their workspace. Those users were told by email to revoke those keys with each provider and replace them.
Console is OpenCode's optional hosted service. A workspace stores its own OpenAI, Anthropic or Google key there, and Console uses that key to call the provider so team members can use the models without ever seeing the credential. The keys at risk are the ones pasted into Console; the OpenCode command-line and desktop apps keep provider keys in a SQLite database on the local machine. Co-founder Dax Raad wrote in a reply on X that the breach involves "the OpenCode Console, not OpenCode itself," and that those keys "never come to us."
The notification went out on the morning of October 17 under the subject line "Action Required: Potential provider key breach." Anyone who did not receive the email was not affected, OpenCode said in a post on X later that day. Recipients were instructed to revoke the old key in the provider's own dashboard, create a new one, and update every application and script that used it.
The exposure matters because a provider key is a bearer credential: whoever holds a copy can run billable requests against the owner's account until the provider revokes it. Deleting the key from Console does not revoke it, and a Console budget cannot cap that use either, since Console only sees requests passing through its own gateway. OpenCode and the providers also advised reviewing usage and billing for requests the user did not make, going back at least to October 16, and setting spend limits or alerts with each tool given its own key.
Some users say they have already paid for usage they did not run. Dealroom reported that Colin Parsons wrote on X that his OpenAI key had been used for $281 and his Anthropic key for $168, while Preston Zeller put his losses at $1,700. Notebookcheck reported a Reddit user's claim of $400 of unauthorized Anthropic usage and another's roughly 200 euros of Google usage, with the project then suspended. Those are the users' own accounts; OpenCode's wording remains that the keys "may have been exposed," and it has not said any key was copied or used.
OpenCode's October 17 post called the incident ongoing, said the company was working with Anthropic, OpenAI and Google to fix it, and described the breach as "related to a large-scale distillation attack." The company has not named anyone or explained how the two connect, what the legacy system was, how it was reached, how many keys it held, or how many users 1.4 percent represents. Distillation is the term model providers use for campaigns that pull a model's answers in huge numbers to train a rival; Anthropic said in September that such labs reach its models through networks of fake accounts built with stolen credit cards, login credentials and harvested API keys.
Attackers were still trying to get into OpenCode's systems on October 18. Raad wrote on X that they had been "non stop trying to attack our systems for the past 48 hours," adding that "a side effect is everything is getting hardened." Affected users remain advised to rotate their keys and monitor provider billing closely.
