OpenCode Console Breach Exposes Third-Party AI Provider API Keys
Legacy system intrusion potentially impacts OpenAI, Anthropic, and Google user credentials.
1Unauthorized Legacy System Access
On October 16, an intruder gained access to a legacy system at OpenCode, potentially exposing third-party AI provider keys stored within the Console service. This optional hosted workspace allows teams to utilize OpenAI, Anthropic, or Google models without directly exposing keys to members. The breach specifically targeted this hosted environment.
2Scope of Affected Users
OpenCode identified that 1.4% of its Console user base was affected by the incident. The company initiated communication on October 17, instructing these specific users to revoke and replace their provider keys immediately. Users who did not receive an email notification were confirmed by the company as not being impacted.
3Technical Vulnerability and Risks
Provider keys function as bearer credentials, allowing anyone holding them to execute billable requests against the owner's account. Because OpenCode Console only monitors requests passing through its gateway, it cannot cap usage or revoke keys externally. Deleting a key from the Console interface does not effectively invalidate the credential at the provider.
4Financial Impact on Users
Multiple users reported unauthorized charges following the breach, with some citing significant financial losses. Colin Parsons noted $281 in OpenAI usage and $168 in Anthropic costs, while Preston Zeller reported $1,700 in losses. Other reports include $400 in unauthorized Anthropic usage and approximately €200 in Google costs, leading to account suspensions.
5Distillation Attack Connection
OpenCode described the incident as related to a large-scale distillation attack, where adversaries extract model outputs to train rival systems. Anthropic previously noted that such campaigns often utilize networks of fake accounts, stolen credit cards, and harvested API keys. Criminal markets frequently resell these tokens to generate illicit profits through billable requests.
6Ongoing Security Response Efforts
Co-founder Dax Raad confirmed that attackers continued attempting to breach OpenCode systems for 48 hours following the initial incident. The company is currently collaborating with OpenAI, Anthropic, and Google to mitigate the situation. Consequently, the company is actively hardening its infrastructure to prevent further unauthorized access to its hosted services.
7Distinction Between Service Layers
The breach was strictly limited to the OpenCode Console service rather than the core OpenCode platform itself. The company clarified that its command-line and desktop applications store provider keys locally in a SQLite database on the user's machine. These local keys were not involved in the server-side legacy system intrusion.
8Strategic Security Implications
This incident highlights the inherent risks of centralizing third-party API credentials within hosted development environments. Organizations must prioritize visibility into their AI attack surface and implement robust permission controls. As AI agents increasingly access sensitive data, securing the lifecycle of bearer credentials remains a critical operational challenge for modern software teams.
Original article: The Hacker News — OpenCode Console Breach Exposes Third-Party AI Provider API Keys