Full Report
The open-source AI coding project OpenCode has notified a small number of users that API keys they used with external providers were exposed in a security breach. [...]
Analysis Summary
# Incident Report: OpenCode API Key Exposure During AI Distillation Attack
## Executive Summary
The open-source AI coding project OpenCode disclosed a security breach tied to a large-scale distillation attack, which exposed API keys that users had linked to external AI providers such as Anthropic, OpenAI, and Google. The breach affected about 1.4% of OpenCode Console users, and some reported unauthorized charges of up to $1,700 plus suspended Google Cloud projects. OpenCode has said no data appears to have been exposed beyond the keys, and it is working with the three providers, though it has not published further details.
## Incident Details
- **Discovery Date:** Saturday, October 17, 2026 (OpenCode's announcement date; exact detection time not disclosed)
- **Incident Date:** Earliest possible key exposure was October 17, 2026, 00:30 UTC, per the user notification. The co-founder said the attackers had targeted the company's systems for at least 48 hours.
- **Affected Organization:** OpenCode (open-source AI coding agent project and its Console service)
- **Sector:** Software development tooling / AI developer services
- **Geography:** Not disclosed
## Timeline of Events
### Initial Access
- **Date/Time:** Attack activity began at least 48 hours before the October 17 announcement. The earliest possible exposure of user keys is October 17, 2026, 00:30 UTC.
- **Vector:** Not disclosed. The article does not explain how attackers obtained the stored API keys.
- **Details:** The attack is described as a "large-scale distillation attack" in which attackers used AI agents to target OpenCode's systems. The article does not establish a confirmed link between the distillation activity and the key exposure mechanism.
### Lateral Movement
- Not disclosed.
### Data Exfiltration/Impact
- **Exfiltrated data:** API keys for external providers (Anthropic, OpenAI, Google) linked by affected Console users. OpenCode states no other data appears to have been exposed. One user-facing message refers to "private key" leaks, which may be imprecise wording.
- **Financial impact:** Unauthorized API charges reported by users, ranging from several hundred USD to over $1,700 overnight.
- **Service impact:** Google suspended some users' projects after detecting "abusive activity consistent with hijacked resources."
### Detection & Response
- **Detection:** OpenCode identified the breach and linked it to the distillation attack. Its co-founder, Dax Raad, said the investigation was hampered when the AI models OpenCode was using refused requests because of built-in safeguards.
- **Stabilization:** The situation reportedly stabilized after OpenCode began using OpenAI's Daybreak AI cybersecurity model for defensive work, which it was approved to use that Saturday.
- **Notification:** Affected users were notified by email on the morning of the announcement. Users who did not receive an email were told they were not impacted.
- **Coordination:** OpenCode says it is working with Google, OpenAI, and Anthropic. It has mentioned possible reimbursement for impacted users.
- **Press contact:** BleepingComputer contacted OpenCode for more details, but had not received a response at publication.
## Attack Methodology
- **Initial Access:** Not disclosed. Stolen API keys were the apparent access mechanism for misuse.
- **Persistence:** Not disclosed.
- **Privilege Escalation:** Not disclosed.
- **Defense Evasion:** Not disclosed. The article notes that attacker activity went on for at least 48 hours before it was addressed.
- **Credential Access:** Theft or exposure of stored API keys for external AI providers. The specific method is not disclosed.
- **Discovery:** The attackers reportedly targeted OpenCode's systems using AI agents. Specific reconnaissance techniques are not disclosed.
- **Lateral Movement:** Not disclosed.
- **Collection:** Not disclosed beyond the API keys.
- **Exfiltration:** Not disclosed. The article says no data beyond the keys appears to have been exposed.
- **Impact:** Unauthorized use of victims' provider accounts (API charges), and provider-side suspension of projects for suspected hijacked resources.
## Impact Assessment
- **Financial:** Individual user charges reported from several hundred USD to over $1,700. Total losses are not disclosed. Reimbursement has been mentioned but not confirmed.
- **Data Breach:** API keys for external providers (Anthropic, OpenAI, Google) for roughly 1.4% of OpenCode Console users. OpenCode says no other data appears exposed.
- **Operational:** Some users had Google Cloud projects suspended, disrupting their work. The scope of other operational impact is unknown.
- **Reputational:** Damage to trust in an open-source AI coding tool that handles provider credentials. Public reporting focused on the breach and the distillation context.
## Indicators of Compromise
- **Network indicators:** None disclosed in the article.
- **File indicators:** None disclosed.
- **Behavioral indicators:**
- Unexpected or unauthorized API usage and charges on linked provider accounts, especially overnight spikes.
- Provider-side alerts for "abusive activity consistent with hijacked resources," which led to project suspensions.
- Large volumes of AI-driven queries consistent with distillation (training smaller models on a larger model's outputs through unauthorized access).
## Response Actions
**Containment**
- Notification of affected users by email. OpenCode asked users to check whether they received an email.
- Engagement of defensive AI tooling (OpenAI Daybreak) to support the response.
**Eradication**
- Not detailed in the article. Presumably includes revoking or rotating exposed keys, but OpenCode has not confirmed this.
**Recovery**
- Possible reimbursement for impacted users (mentioned, not confirmed).
- Ongoing coordination with Google, OpenAI, and Anthropic to address the incident and restore suspended projects.
## Lessons Learned
- **Stored third-party credentials are high-value targets.** Keys linked to external AI providers can be abused quickly and at high cost, as shown by overnight charges of over $1,700.
- **Provider safeguards can slow incident response.** OpenCode said AI models it was using refused requests because of built-in safeguards, which hampered its investigation. Responders should plan for this and have alternative tooling ready.
- **Detection lag.** Attackers reportedly operated for at least 48 hours before the response took effect, and the breach was not identified until its impact reached users.
- **Notification scope was narrow.** Only users with external providers linked were notified, and users had to check whether they had received an email to know if they were affected.
- **Open questions remain.** The article does not explain how the keys were exposed, which limits the lessons that can be drawn about the root cause.
## Recommendations
**For affected users**
- Immediately rotate all API keys linked to external providers (Anthropic, OpenAI, Google), and review billing and usage logs for unauthorized activity.
- Check Google Cloud and other provider consoles for suspended projects or unfamiliar resources.
- Set spending limits and budget alerts on all AI provider accounts.
- File reimbursement requests with OpenCode and providers if charges were unauthorized.
**For tool maintainers and similar platforms**
- Avoid storing long-lived provider API keys where possible. Use short-lived tokens, scoped credentials, or a secrets manager with encryption and strict access controls.
- Enforce per-key spending caps and anomaly-based billing alerts.
- Monitor for distillation-like query patterns and automated abuse from AI agents.
- Publish clear, detailed incident reports that include root cause, timeline, and indicators of compromise, so users can assess their own exposure.
- Prepare an incident response plan that does not depend solely on third-party AI models, which may refuse security-related work.
**For organizations using AI coding tools**
- Treat AI provider keys as privileged credentials. Store them in a secrets manager, not in tool configuration files.
- Apply least privilege to keys and restrict them to specific models, IP ranges, or environments where supported.
- Include AI provider accounts in regular credential rotation and access reviews.