OpenCode Console Breach May Have Exposed AI Provider Keys from OpenAI, Anthropic, and Google

A security breach on October 16 at OpenCode's legacy systems may have exposed third-party AI provider keys stored by users in OpenCode Console — putting API credentials for OpenAI, Anthropic, and Google at risk.

The incident highlights a growing and underappreciated vulnerability in the AI development ecosystem: the API key. As developers increasingly rely on hosted AI platforms to streamline workflows, the keys that grant access to those models have become high-value targets for attackers. For affected users, the consequences are not just technical — they are financial.

Understanding how application programming interfaces and API credentials work is increasingly essential for any developer or team using hosted AI services — because when those credentials are compromised, the damage is immediate.

---

What Happened and Who Is Affected

OpenCode disclosed the breach on October 17 in an email sent to affected users under the subject line "Action Required: Potential provider key breach." The company confirmed that an intruder accessed a legacy system on the night of October 16 and may have reached provider keys stored within Console, its optional hosted workspace service.

Console works by allowing teams to store a single OpenAI, Anthropic, or Google API key in a shared workspace. Team members can then use AI models without ever directly handling the key. That convenience, it turns out, created a centralised point of failure — a single compromised system capable of exposing credentials across an entire team.

The affected group represents 1.4% of Console users — specifically those who had linked an outside provider key. OpenCode has not disclosed how many total users Console has, making it impossible to determine the exact number of people affected.

OpenCode co-founder Dax Raad was quick to draw a distinction between the affected service and the core product. "The breach involves the OpenCode Console, not OpenCode itself," Raad wrote in a reply on X. He added that keys stored locally via the OpenCode command-line and desktop apps — which save provider keys in a SQLite database on the user's own machine — were not involved. Those keys "never come to us," he said.

Anyone who did not receive the October 17 email was not affected, OpenCode stated in a follow-up post on X.

Why Centralised Key Storage Carries Inherent Risk

This incident is a clear example of how architectural convenience can introduce structural security risk. When a single hosted workspace holds credentials on behalf of many users, the security posture of every individual on that workspace becomes dependent on the security of the platform itself — not just their own practices. A breach at the platform level becomes a breach for every user whose credentials it holds.

The risks associated with this type of sensitive data exposure in shared environments are well documented, yet centralised credential storage remains common across developer tooling.

---

The Financial Damage Is Already Mounting

A provider API key is what security professionals call a bearer credential — whoever possesses it can run billable requests against the account owner's account until the key is revoked. Critically, deleting a key from Console does not revoke it at the provider level. A Console budget cap also offers no protection for usage that bypasses Console's own gateway.

For some users, unauthorised charges appeared almost immediately:

• Colin Parsons reported on X that his OpenAI key had been used for $281 and his Anthropic key for $168
• Preston Zeller reported losses of $1,700
• A Reddit user cited by Notebookcheck claimed $400 in unauthorised usage on an Anthropic account
• Another user reported approximately €200 in Google usage before the project was suspended entirely

OpenCode's own language remains cautious. The company has said keys "may have been exposed" and has not confirmed that any key was definitively copied or used by an unauthorised party.

The Broader Threat Context: Distillation Attacks and Criminal Markets

The broader context adds urgency. In September, Anthropic warned that actors behind large-scale distillation campaigns — operations designed to harvest AI model outputs in bulk and train competing models — reach providers through networks of fake accounts built with stolen credit cards, login credentials, and harvested API keys. Criminal markets also actively resell AI tokens and keys to run up fraudulent charges.

OpenCode described the breach as "related to a large-scale distillation attack" but has not explained how the two events are connected. This is a significant gap in their disclosure — users deserve clarity on whether the breach was opportunistic or part of a targeted campaign.

Attacks on OpenCode's systems were reportedly still ongoing as of October 18. Raad wrote on X that bad actors had been "non stop trying to attack our systems for the past 48 hours," adding that "a side effect is everything is getting hardened."

---

What Affected Users Should Do Now

OpenCode's breach email and guidance from the three providers outline a clear set of steps for anyone whose key may have been exposed.

Immediate Steps to Take

1. Revoke the compromised key immediately through the provider's own dashboard — not through Console — and generate a new one. OpenAI, Anthropic, and Google each provide instructions for this process on their respective platforms.
2. Update every application, script, or integration that relied on the old key. A replaced key that remains in active use elsewhere creates a new exposure point.
3. Review billing and usage history at each provider going back to at least October 16 and flag any requests you did not initiate.

Longer-Term Security Practices Worth Adopting

Even if you were not affected by this breach, the incident presents an opportunity to reassess how API credentials are managed across your tools and team.

OpenCode recommends setting spend limits or billing alerts at the provider level and assigning each tool or application its own dedicated key. That approach limits the blast radius if any single key is compromised and makes unauthorised usage easier to detect and trace.

Treat API keys with the same seriousness as passwords. They are bearer credentials — anyone who holds one can spend your money and act on your account without restriction. Store them in a dedicated secrets manager rather than in shared workspaces or plain-text configuration files, and rotate them on a regular schedule regardless of whether a breach has occurred.

Understanding how to prevent a data breach at the credential level is no longer a concern reserved for enterprise security teams — it is a practical necessity for any developer working with third-party AI APIs.

What OpenCode Has Not Yet Disclosed

OpenCode has not disclosed when unauthorised access began, how the legacy system was reached, what that system was, or the total number of keys it held. The company said it is working with Anthropic, OpenAI, and Google to address the incident. As the investigation continues, affected users should monitor official communications from both OpenCode and their respective AI providers for further guidance.