OpenCode Breach Leaked AI API Keys: What Developers Must Do Now

OpenCode says a breach exposed OpenAI, Anthropic and Google keys saved by 1.4% of Console users. What happened and how to lock down your AI API keys.

TheTechLane cover: OpenCode breach leaked AI API keys, with a glowing key breaking out of a cracked server

If you've ever pasted an OpenAI or Anthropic key into a hosted dev tool and forgotten about it, this weekend is your reminder to go check. OpenCode, the popular open-source AI coding agent, says a security breach exposed third-party AI provider keys saved by some users of its paid Console product. Some developers say they woke up to hundreds of dollars in usage they never made.

Here's what we know, what we don't, and what to do about it.

What happened

On 17 October 2026, OpenCode emailed a subset of Console users with the subject line "Action Required: Potential provider key breach." According to the email, as reported by The Latent and Safeguard, the team had "identified unauthorized access to a legacy system that we were in the process of decommissioning," and third-party provider keys "saved in your workspace may have been exposed."

Later that day (18:08 UTC, or 11:38 PM IST), OpenCode posted on X:

"We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users. We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked."

The company added that the incident was ongoing, that it could not share more details yet, and that it was working with Anthropic, OpenAI and Google to remediate.

So far, OpenCode has not said how the attacker got in, how long they had access, exactly how many people were affected, or whether it will reimburse anyone.

Who is affected

The exposure is tied to OpenCode Console, the hosted part of the product, not to the open-source agent that runs on your machine. Console sells pay-as-you-go access to models OpenCode has tested with its coding harness. Workspace admins can also connect their own provider accounts, and Console stores those keys on its servers.

Those saved keys are what leaked. OpenCode's statements describe keys stored in Console workspaces. They do not mention keys kept only in local environment variables or local config files.

The scale of the tool is why this matters. The Latent reports that OpenCode, built by Anomaly, has about 215,000 GitHub stars and works with models from more than 75 providers, and the company says 16 million developers use the agent every month. Even 1.4% of Console users can be a lot of people, though OpenCode hasn't shared an absolute number.

The surprise bills

Users spotted the problem before OpenCode said anything publicly. According to The Latent, developer Colin Parsons posted on X that his OpenAI key had been "pounded" for $281 of usage starting at 2 a.m. ET, and his Anthropic key for $168. He said he used both keys only in OpenCode. Other users replied with similar stories, including one who put his losses at $1,700 and another who said his OpenAI account had been suspended. The Latent noted that it could not independently verify these reports.

Dax Raad, who builds OpenCode at Anomaly, posted that his own personal accounts were "being attacked now too."

Why a "distillation attack" wants your keys

OpenCode hasn't explained how it linked the leak to a "large scale distillation attack." But the term has a fairly specific meaning in AI right now.

Distillation is when someone trains or improves a model using the outputs of another, usually stronger, model. Doing that at scale means making a huge number of paid API calls to frontier models. A stolen API key flips the economics: the attacker gets the outputs and the victim gets the bill.

So the prize here wasn't passwords or card numbers. It was paid access to expensive models, sitting in one string of text.

It also fits a wider pattern. The Latent notes that U.S. agencies in September accused six Chinese firms, including DeepSeek and Moonshot AI, of extracting billions of tokens from American models to train their own. OpenAI has also said it shut down a Moonshot-linked campaign to extract reasoning traces from its models in July. To be clear, nobody has publicly tied the OpenCode incident to any specific company.

What it means for developers

The biggest lesson is not really about OpenCode. It's about how we treat AI API keys.

An AI key is now money. A leaked database password is bad. A leaked frontier-model key is bad and costs you money every minute it stays live. Treat these keys like a corporate card number, not a config value.

Bring-your-own-key tools concentrate risk. Aggregators and gateways are convenient precisely because you can link OpenAI, Anthropic and Google in one place. But as Safeguard puts it, that makes the gateway's weakest system, in this case a legacy one being retired, the gate to all three accounts.

Legacy systems are a real attack surface. The breach reportedly came through a system OpenCode was in the process of shutting down. If you run a platform that stores customer secrets, decommissioning means wiping the secrets too, not just routing traffic away.

What to do right now

If you got the OpenCode email, or you have ever saved a provider key in a Console workspace:

  1. Revoke keys at the provider, not just in OpenCode. OpenCode's email asks users to revoke keys through each provider's dashboard. Removing a key from OpenCode doesn't stop someone who already copied it.

  2. Create the replacement first, then revoke the old key. Safeguard points out that Google's own guidance for a compromised Gemini key follows this order. It avoids an outage in your own apps.

  3. Check usage from 16 October onward, by day and by model, on the OpenAI, Anthropic and Google dashboards. Look further back if you can, since OpenCode hasn't said when access began.

  4. Update every copy of the key. CI secrets, .env files, local agent configs and teammates' machines often hold the same key.

  5. Confirm the old key is dead. A simple request to the provider's models endpoint with the old key should now return an authentication error, not a 200.

Habits worth adopting even if you weren't hit

  • One key per tool. If a tool leaks, you rotate one key, not your production key.

  • Scope keys to a project where the provider supports it, instead of using broad, account-wide keys.

  • Set hard spending limits, not just alerts. An email alert tells you spend crossed a line. It doesn't stop anything. Pair alerts with caps where the provider offers them.

  • Scan your repos for secrets, including old commits. Strings that start with sk- or AIza have a way of turning up in places you forgot about.

What to watch next

OpenCode says it will share more as it learns more. The open questions: how the attacker got in, how long they had access, and who covers the unauthorized charges.

FAQ

I only use OpenCode locally with keys in environment variables. Am I affected? OpenCode's statements describe keys saved in Console workspaces and say users who didn't get an email were not impacted. If you never saved keys in Console and got no email, you're outside what OpenCode has described. Rotating anyway is cheap insurance.

Will I get my money back for unauthorized usage? Unknown for now. OpenCode hasn't said whether it plans to reimburse affected users. It says it is working with Anthropic, OpenAI and Google on remediation, so contact those providers' support teams with your usage records.

What is a distillation attack? It's an attempt to train or improve an AI model using large volumes of outputs from another model. It needs lots of paid API calls, which is why stolen keys are valuable to attackers.

Sources

Follow TheTechLane

Keep learning AI, development, and modern developer technologies with TheTechLane.

Learn • Build • Share

Follow @thetechlanehq for more developer guides, tutorials, and practical technology content.