OpenCode breach may have exposed users' AI provider keys

OpenCode disclosed that an unauthorized party reached a legacy system behind OpenCode Console on the night of October 16 and may have exposed third-party AI provider API keys that users had stored there. Console is OpenCode's hosted option: a workspace saves its OpenAI, Anthropic, or Google key, and Console calls the provider on the team's behalf so members use the models without handling the key directly. The company notified affected users by email on October 17 with the subject "Action Required: Potential provider key breach" and posted on X the same day.

No detailed vendor advisory page has been published; the fullest public accounts are at The Hacker News and the OECD AI incident record.

What's affected

• The incident touched roughly 1.4% of Console users — the subset who had an external provider linked. OpenCode has not said how many users that represents.
• OpenCode's wording is that keys "may have been exposed"; it has not confirmed any key was copied or used.
• Keys stored by the OpenCode command-line and desktop apps — kept in a local SQLite database — are not affected. Co-founder Dax Raad said those keys "never come to us."

Anthropic confirmed a response: Lydia Hallie said Anthropic revoked Claude API keys it believed were affected. Several users have reported unauthorized charges on their OpenAI, Anthropic, and Google accounts; those reports are self-reported and unverified.

On the "distillation attack" framing

OpenCode described the incident as "related to a large-scale distillation attack," and on October 18 Raad said attackers had been "non stop trying to attack our systems for the past 48 hours." The company has not explained how a distillation attempt connects to the key exposure, and at least one write-up notes the remediation advice is ordinary incident response. Treat the "distillation" label as the vendor's characterization, not an established fact — this is the AI beat, and vendor framing of an AI incident deserves extra skepticism.

Action checklist

1. Revoke and reissue any OpenAI, Anthropic, or Google key you stored in OpenCode Console — do it from the provider's own dashboard, not via a link in any notification email.
2. Review provider usage and billing back to at least October 16; OpenCode has not said when access began.
3. Note that deleting a key from Console does not revoke it at the provider — you must rotate it at the source.
4. Set a spend limit or alert at each provider, and give each tool its own scoped key so one leak is contained.

Context

The lesson is broader than one product: a coding agent or hosted dev tool that stores provider keys is a credential vault most teams never audit, and provider keys are bearer tokens — whoever holds one can spend against it until it is revoked. The exposure here was not a clever exploit but a legacy system still holding secrets during decommissioning, the same unglamorous failure mode behind a long line of key-leak incidents.