An intruder accessed an OpenCode legacy system on the night of October 16, potentially exposing third-party AI provider keys that users had pasted into OpenCode Console, according to The Hacker News’s account of the company’s statements.
OpenCode said the potential exposure affected 1.4% of Console users, all of whom had connected an outside provider. The percentage does not reveal the number of users or API keys involved.
The company’s wording remains conditional: the keys “may have been exposed.” OpenCode has not said that any credential was copied or subsequently used.
OpenCode notified affected Console users on October 17
On the morning of October 17, OpenCode sent emails with the subject “Action Required: Potential provider key breach” to users it considered affected. Later that day, the company said on X that the incident was ongoing and that it was working with Anthropic, OpenAI and Google.
OpenCode also told users that anyone who did not receive the email was unaffected. The company attributed the breach to what it called a “large-scale distillation attack,” but did not identify an actor or explain how such activity led to the legacy-system intrusion.
On October 18, co-founder Dax Raad wrote that attackers had been targeting OpenCode’s systems “non stop” for the previous 48 hours. That statement does not establish when unauthorized access to the affected system began.
Raad characterized the incident as involving “the OpenCode Console, not OpenCode itself.” In practical terms, the reported exposure is limited to provider keys entered into Console.
According to Raad, keys added through OpenCode’s command-line and desktop applications are stored locally in a SQLite database on the user’s machine and “never come to us.” Those locally stored credentials therefore fall outside the scope described by the company.
Why a potentially exposed provider key requires replacement
API keys for OpenAI, Anthropic and Google function as bearer credentials. Anyone possessing a valid key may be able to submit requests billed to its owner until the provider revokes it.
Deleting a key from OpenCode Console is not sufficient because removal from the Console does not invalidate the credential at the provider. Similarly, a budget configured inside Console cannot limit requests made directly with the key: OpenCode can track only traffic passing through its gateway.
Users notified by OpenCode should:
- Revoke the affected key in the relevant provider’s dashboard and generate a replacement.
- Replace the old credential in every application, script and service that used it.
- Examine provider usage and billing records for unfamiliar requests going back at least to October 16.
- Configure spending limits or billing alerts with the provider where available.
- Use a separate API key for each tool, reducing the number of systems that must be updated after a credential exposure.
Revocation is the critical step. Rotating a key without updating dependent applications can also interrupt legitimate workloads, so users should identify each place where the old credential was configured.
Users report unauthorized AI usage, but the cause is unconfirmed
Several users have separately claimed unexpected charges on their provider accounts. Dealroom reported that Colin Parsons attributed $281 in unauthorized OpenAI usage and $168 in Anthropic usage to his account. It also cited Preston Zeller as reporting $1,700 in losses.
Notebookcheck reported claims from two unnamed Reddit users: one described $400 in unauthorized Anthropic usage, while another cited about €200 in Google usage before the project was suspended.
These are user-reported figures. OpenCode has said only that the keys “may have been exposed” and has not said that any key was copied or used. The reports therefore do not establish that exposed keys were copied or abused.
OpenCode’s own account supports immediate credential rotation because exposure is possible, but it stops short of confirming theft or misuse. For affected users, provider-side revocation, replacement and billing review are the measures that directly contain that risk.
