Full Report
An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team members can use the models without
Analysis Summary
# Incident Report: OpenCode Console Breach Exposes Stored Third-Party AI Provider Keys
## Executive Summary
An intruder accessed a legacy system at OpenCode on the night of October 16, 2026, potentially exposing OpenAI, Anthropic, and Google API keys that customers had saved in OpenCode Console. OpenCode says the affected group is 1.4% of Console users, all of whom had an outside provider linked, and has instructed them to revoke and replace those keys. As of the reporting, OpenCode had not confirmed that any key was copied or misused, though some users reported unauthorized charges, and the company described the incident as ongoing.
## Incident Details
- **Discovery Date:** Not explicitly disclosed. OpenCode notified affected users by email on the morning of October 17, 2026, and publicly referenced the incident on X later that day.
- **Incident Date:** Night of October 16, 2026 (per OpenCode). The start of unauthorized access may be earlier; OpenCode has not said when it began.
- **Affected Organization:** OpenCode (developer of the OpenCode CLI, desktop apps, and the hosted Console service)
- **Sector:** Software development tools / AI services
- **Geography:** Not disclosed
## Timeline of Events
### Initial Access
- **Date/Time:** Night of October 16, 2026 (per OpenCode). Start time unknown.
- **Vector:** Not disclosed. OpenCode has said only that an intruder "reached a legacy system."
- **Details:** OpenCode has not described what the legacy system was, how it was reached, or whether it was internet-facing. Co-founder Dax Raad stated the breach involved "the OpenCode Console, not OpenCode itself," and that the affected keys "never come to us," meaning the CLI and desktop apps were not the source.
### Lateral Movement
- Not disclosed. OpenCode has not said whether the intruder moved from the legacy system to Console data stores or other systems.
### Data Exfiltration/Impact
- **Data at risk:** Third-party AI provider API keys (OpenAI, Anthropic, Google) saved by workspaces in Console. Console stores these keys so team members can use models without seeing them.
- **Scope:** 1.4% of Console users, all with an outside provider linked. OpenCode has not stated the total number of keys held or the number of affected users.
- **Confirmed misuse:** None confirmed by OpenCode. Its wording is that keys "may have been exposed."
- **Reported unauthorized usage (unverified, user-reported):**
- Colin Parsons: $281 on an OpenAI key and $168 on an Anthropic key (per Dealroom, citing X posts)
- Preston Zeller: losses of $1,700
- A Reddit user: $400 of unauthorized Anthropic usage
- Another user: about €200 of Google usage, after which the project was suspended (per Notebookcheck)
- **Context:** OpenCode's October 17 post described the breach as "related to a large-scale distillation attack." The company has not explained how this connects to the intrusion.
### Detection & Response
- **Detection:** The article does not describe how the intrusion was detected.
- **Response actions taken:**
- Emailed affected Console users on October 17 under the subject "Action Required: Potential provider key breach," telling them to revoke and replace provider keys.
- Posted a public statement on X on October 17 calling the incident ongoing.
- Said it is working with Anthropic, OpenAI, and Google to address the issue.
- **Ongoing activity:** On October 18, Raad said attackers had been "non stop trying to attack our systems for the past 48 hours" and that the company was hardening its systems as a result.
## Attack Methodology
- **Initial Access:** Not disclosed. OpenCode referred to a "legacy system" but did not describe the access method.
- **Persistence:** Not disclosed.
- **Privilege Escalation:** Not disclosed.
- **Defense Evasion:** Not disclosed.
- **Credential Access:** Likely involved access to stored provider keys in Console. The article does not confirm the technique.
- **Discovery:** Not disclosed.
- **Lateral Movement:** Not disclosed.
- **Collection:** Not disclosed. The article does not state whether keys were decrypted, read in plaintext, or exported.
- **Exfiltration:** Not confirmed. OpenCode has not said any key was copied.
- **Impact:** Possible unauthorized API usage billed to customer accounts, as reported by some users. Not confirmed by OpenCode or the providers in the article.
## Impact Assessment
- **Financial:** Users report unauthorized charges of roughly $168 to $1,700 each, plus a reported €200 for a Google project. These are self-reported and unverified. OpenCode has not published aggregate costs.
- **Data Breach:** Potentially exposed third-party AI provider API keys for the 1.4% of Console users with linked providers. Customer data beyond keys was not mentioned. The article does not say whether prompts, code, or other content were accessed.
- **Operational:** Affected customers must revoke and replace keys, update every application and script that used them, and audit provider billing. Some projects were suspended, per user reports.
- **Reputational:** Public reports, user complaints, and an ongoing incident narrative. OpenCode has been transparent about the breach but has not answered key questions.
## Indicators of Compromise
- **Network indicators:** None published. The article references vendor and provider domains only as sources (for example, dev[.]opencode[.]ai and x[.]com). These are references, not IOCs.
- **File indicators:** None published. The article mentions local SQLite databases used by the CLI and desktop apps, but OpenCode said those keys were not affected.
- **Behavioral indicators:**
- Unexpected billable API requests on OpenAI, Anthropic, or Google accounts, especially starting on or after October 16, 2026
- Usage spikes or charges for requests the account owner did not make
- Sudden project suspensions or spending alerts at providers
## Response Actions
- **Containment measures:** Not disclosed. OpenCode has said it is hardening its systems and that attacks continued into October 18.
- **Eradication steps:** Not disclosed. The article does not say whether the legacy system was removed or patched.
- **Recovery actions (recommended to customers in OpenCode's guidance):**
1. Revoke the affected key in the provider's dashboard and create a new one, following provider guidance.
2. Update every application and script that used the old key.
3. Review provider usage and billing for unauthorized requests going back at least to October 16, 2026.
4. Set spend limits or alerts at the provider, and issue a separate key for each tool to limit exposure and aid tracing.
Note that deleting a key from Console does not revoke it, and Console budgets do not cap usage outside Console's gateway.
## Lessons Learned
- **Key takeaways:**
- A stored provider key is a bearer credential. Anyone holding a copy can make billable requests until the provider revokes it.
- Deleting a key from a management console does not invalidate it at the provider.
- Hosted services that hold customer third-party credentials are high-value targets, and a single legacy system can expose them.
- Customers have limited visibility into what a hosted vendor stores or how it protects those secrets.
- **What could have been done better:**
- Legacy systems holding credentials should have been inventoried, isolated, or retired.
- Provider keys could have been encrypted with keys held outside the compromised system, or replaced with short-lived tokens.
- Early disclosure lacked specifics: the timeline of access, the number of keys at risk, and the intrusion method remain unclear. Customers were left to act without a full picture.
- The "distillation attack" framing was introduced without explanation, which may complicate the public understanding of the incident.
## Recommendations
- **For affected customers:**
- Rotate all provider keys saved in Console. Do not rely on deleting them.
- Review provider billing and usage logs from October 16, 2026 onward.
- Set hard spend limits and anomaly alerts at each provider.
- Use one key per application or tool, and label keys so misuse is traceable.
- Store keys in a dedicated secrets manager rather than in hosted service dashboards where possible.
- **For OpenCode and similar vendors:**
- Inventory and isolate legacy systems that hold or can reach customer credentials. Retire them where possible.
- Encrypt stored third-party credentials with keys that are not accessible from the application database, and restrict decryption to narrowly scoped services.
- Prefer short-lived or scoped tokens over long-lived bearer keys.
- Log and alert on bulk access to credential stores.
- Publish a detailed post-incident report covering the timeline, access method, number of affected keys, and any confirmed misuse.
- **For AI providers:**
- Monitor for usage spikes on keys that may be exposed, and offer proactive notifications to affected account holders.