OpenCode breach exposed saved AI keys, users hit with surprise bills

On Saturday morning a number of developers opened their inbox and found an email with a subject line nobody wants to see: "Action Required: Potential provider key breach". It came from OpenCode, the open source coding agent that millions of developers run in their terminal, their editor or a desktop app. A few hours later the project confirmed it in public. Someone had broken into one of its systems, and the API keys that some users had saved there for OpenAI, Anthropic, Google and other model providers may now be in the wrong hands.

For some of those users, the email was not the first warning. Their provider dashboards had already shown it: usage they did not recognize, starting in the middle of the night, billed to their own accounts.

The three things you need to know

• What happened: OpenCode says an attacker gained unauthorized access to a legacy system it was in the process of shutting down. Third party provider keys saved in OpenCode Console workspaces of 1.4% of Console users may have been exposed. All of them were notified by email.
• Why it happened: OpenCode says the breach was "related to a large scale distillation attack". Distillation means using the answers of a strong AI model to train another model. Several users report surprise charges on their keys, from a few hundred to a few thousand dollars.
• What is being done: Anthropic has revoked Claude API keys it believes were affected, Google has blocked exposed Gemini API keys, and OpenCode says refunds for affected users are already underway. If you ever saved a provider key in OpenCode Console, rotate it now.

What OpenCode actually said

OpenCode posted its statement on X on 17 October 2026 at 1:56 pm US Eastern Time and edited it a few minutes later. The final version reads: "We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users. We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers". The project added that the incident was still ongoing, that it could not share more details yet, and that it was working with Anthropic, OpenAI and Google on remediation.

The customer email, which security writer Matt Johansen shared on X, adds two important details. First, the attacker reached "a legacy system that we were in the process of decommissioning". Second, the exposed data is "third party provider keys (eg OpenAI, Anthropic) saved in your workspace". Users were told to revoke those keys in each provider's dashboard, update every app that uses them, and watch their accounts for unexpected usage.

What OpenCode Console is, and why the keys were there

To understand who is affected, it helps to separate two things that share a name. OpenCode is the open source agent itself. You install it, point it at a model and let it read and write code. According to The Latent, it works with models from more than 75 providers, its GitHub repository has about 215,000 stars, more than OpenAI's Codex CLI or Google's Gemini CLI, and the company behind it, Anomaly, says 16 million developers use it every month.

OpenCode Console is the paid web product around it. It sells pay as you go access to models that OpenCode has tested with its coding harness. Workspace admins can also connect their own provider accounts, and in that case Console stores the provider key on its servers and adds it to the requests it forwards. These stored keys are the ones in question.

That distinction matters a lot. Dax Raad, who builds OpenCode at Anomaly, clarified on X that the breach is in Console, not in the OpenCode app, and that keys used with the app locally "never come to us". If you only ever used OpenCode on your own machine with keys in a local config file or environment variable, you are not part of this incident, based on everything OpenCode has said so far.

The surprise bills

The first public signs did not come from OpenCode. They came from users looking at their own invoices. Johansen, who runs the security newsletter Vulnerable U, wrote on Saturday that people were messaging him about API keys "running up charges".

The Latent collected several reports. One developer wrote on X, before OpenCode had said anything, that his OpenAI key had been used for $281 worth of requests starting at 2 am Eastern Time and his Anthropic key for $168, and that he had only ever used both keys in OpenCode. Others replied with their own numbers: one user put his losses at $1,700, another saw "over 700 in openai usage before I pulled the plug". Notebookcheck found a Reddit report of $400 in unauthorized charges on an Anthropic account and another user whose Google project was suspended for abuse after charges of around 200 euros. The incident tracker ctxsec lists reported amounts from roughly $65 to about $3,000.

None of these numbers are confirmed by OpenCode, and The Latent says it could not verify them independently. OpenCode has not disclosed how many people are affected in absolute terms, how much was spent with stolen keys, or exactly how long the keys were exposed. What we do know is that some accounts were hit hard enough that providers stepped in: at least one user said his OpenAI account was suspended, and another said his Google Cloud account was restricted.

What a distillation attack has to do with it

OpenCode did not explain how it linked the stolen keys to a "large scale distillation attack". The most likely reading, which several security writers share but OpenCode has not confirmed, is simple. Whoever took the keys used them to send large volumes of requests to frontier models and collect the answers, so those answers can be used to train or improve another model. The attacker gets premium model output for free, and the bill lands with the developer whose key was stolen.

This fits a pattern that has been building for months. AI labs have made it harder to harvest their models directly. Anthropic described in February how distillers abuse its API, and on 12 October it reported that its new defenses cut the reasoning data distillers can extract by roughly 90 to 99 percent, which we covered in our piece on Anthropic's distillation defenses. In September, according to The Latent, US agencies accused six Chinese firms, including DeepSeek and Moonshot AI, of extracting billions of tokens from American models. When the front door gets locked, attackers look for side doors. A service that holds working keys for several providers at once is exactly such a door.

How the providers reacted

The response came quickly, at least from two of the three big providers OpenCode named. At 5:04 pm Eastern Time, Lydia Hallie from Anthropic's Claude Code team said Anthropic had been working with OpenCode and had revoked Claude API keys it believed were affected. If your Claude key suddenly returns authentication errors, that is probably why, and you need a new one. At 6:53 pm, Evan Otero from Google said Google was aware of the incident involving Gemini API keys stored in OpenCode, had blocked the exposed keys and was working with affected customers. As of late Saturday, OpenAI had not made a similar public statement, according to ctxsec.

At 8:01 pm, Raad wrote that OpenCode had already contacted everyone affected and that refunds were underway. He asked users who were drained but did not receive an email to contact him directly with details. Earlier, he had also written that his own personal accounts were "being attacked now too".

What we still do not know

There are several open questions, and it is worth being honest about them. OpenCode has not said how the attacker got into the legacy system, which system it was, or when the access started and ended. It has not said whether anything other than provider keys was exposed, such as OAuth tokens, Console API keys or account data. The email only mentions provider keys. It has not explained the term "distillation attack" or said whether it knows who is behind it. And it has not said how refunds work for charges billed by OpenAI, Anthropic or Google rather than by OpenCode itself. We will update this article when OpenCode publishes more.

What to do now

If you ever saved a provider key in an OpenCode Console workspace, do not wait to find out whether you were in the 1.4 percent. Treat the key as exposed.

• Create a new key at every provider you connected, then delete the old one. That includes OpenAI, Anthropic, Google AI Studio or Google Cloud, OpenRouter and xAI, depending on what you linked.
• Check usage and billing at each provider since 16 October. Look for spikes, unfamiliar models and unusually high output token counts.
• Set hard spending limits. Most providers support monthly limits, and some support caps per key. A limit will not stop a theft, but it turns a disaster into an annoyance.
• Turn on usage and billing alerts, so the next anomaly reaches you in minutes and not the next morning.
• If you keep using Console, link a fresh key that is used only for OpenCode, so you can revoke it on its own.
• Report unauthorized charges to the provider and to OpenCode. Send usage screenshots, never the key itself, and be careful with look alike emails asking you to "verify" a key.

Why it matters

The first reason is that AI keys have become money. A stolen password usually needs extra work before it pays off. A stolen frontier model key pays off immediately, because every request is billed to someone else and the output can be sold or used for training. That makes API keys one of the most attractive targets in software right now, and the bills in this incident show how quickly they can be drained.

The second reason is concentration. Gateways, routers and agent platforms are convenient precisely because they hold keys for many providers in one place. That same convenience means one breach exposes access to several labs at once. OpenCode is not the only tool that works this way, and it will not be the last one to be targeted.

The third reason is the type of system that was hit. It was a legacy system that OpenCode was already retiring. Old systems are where security usually decays first, because nobody owns them anymore and every team assumes they will be gone soon. We saw the same theme in the CERT-In advisory on AI agents in Indian companies, where forgotten test APIs and leaked keys were the way in. The lesson is the same: a system you are shutting down is still a live system until it is actually off.

Dany's take

OpenCode is a tool many developers rely on, and I think the team handled the communication reasonably well: an email to affected users within hours, a public post the same day, clear advice to rotate keys, and refunds already promised. That is better than many companies manage after a breach. But the incident is a good reminder of something a lot of us ignore. We paste our API keys into every new tool that promises to save us time, and then we forget about them. Most of those keys have no spending limit and no alert. My suggestion for today: give every tool its own key, set a hard monthly limit on each one, turn on billing alerts and delete the keys you no longer use. A key with a fifty dollar limit is a bad day. A key with no limit can be a very bad month. And to every company that stores customer keys: if you are decommissioning a system, rotate or delete the secrets in it first.

What this means for you

If you are a developer who uses AI coding tools, this is the moment to make an inventory. Which services have a copy of your OpenAI, Anthropic or Google keys? Which of them do you still use? Rotate anything you are not sure about, add spending limits and alerts, and prefer tools that keep keys on your own machine or let you connect with short lived, scoped credentials. If you run a team, make key ownership explicit: every key should have a person responsible for it, a budget and an expiry date.

Sources

• OpenCode statement on X (17 October 2026)
• OpenCode says breach tied to distillation attack exposed users' AI provider keys (The Latent)
• OpenCode hacked, users urged to revoke their API keys (Notebookcheck)
• OpenCode Console breach: provider API keys may be exposed (ctxsec incident summary)
• OpenCode discloses distillation attack that hit 1.4% of Console users (Crypto Briefing)