OpenCode Console breach via legacy system exposes AI provider API keys of 1.4% of users, with unauthorized charges reported

Linha do tempo

1. infosecurity-magazine.com ↗ · pub. 19/10/2026 10:30 · coletado 20/10 16:31

   OpenCode Console breach via legacy system may expose OpenAI, Anthropic and Google API keys

   ler a análise desta fonte ocultar

   OpenCode, the open-source AI agent framework developed by Anomaly, confirmed on October 17 a security breach that occurred the night before and affected its Console service. Console stores each workspace's third-party AI provider credentials centrally. About 1.4% of Console users, those with external providers linked, may have had OpenAI, Anthropic or Google API keys exposed. OpenCode described the incident as related to a "large-scale distillation attack" and said it involved unauthorized access to a legacy system being decommissioned. It notified affected users by email and informed Anthropic, OpenAI and Google. Co-founder Dax Raad stated that only the Console was affected, not OpenCode itself.

   Technical Details

   • Unauthorized access to a legacy system that was being decommissioned. The article does not state the initial access method.
   • Console holds workspace-level provider credentials and uses them to authenticate requests to OpenAI, Anthropic and Google, so the keys may have been exposed.
   • The article attributes the incident to a "large-scale distillation attack", per OpenCode. No threat actor is named and no IOCs are published.
   • Affected users received an email titled "Action Required: Potential provider key breach."
   • OpenCode has about 217,000 GitHub stars and, per a July 2026 claim by its CEO, roughly 13 million monthly active users.

   Remediation

   Per Safeguard's recommendations:

   • Check your inbox for the notification email. If you did not receive it, review your keys anyway.
   • List every OpenAI, Anthropic and Google Gemini key ever stored in a Console workspace, including keys added by other admins.
   • Review provider usage and billing from October 16 onward for spikes, unfamiliar models or unexplained charges.
   • Create replacement keys first, then revoke the old ones. Do not assume a key is safe because it shows no suspicious usage.
   • Update CI/CD secrets, environment files, agent configurations and production applications, then confirm the revoked keys return authentication errors.
   • Use restricted, project-specific keys with spending limits and budget alerts. If you keep using Console, add a dedicated restricted key rather than a production key.
2. gbhackers.com ↗ · pub. 20/10/2026 02:51 · coletado 20/10 03:00

   OpenCode discloses breach affecting 1.4% of Console users, attributed to a 'large-scale distillation attack'

   ler a análise desta fonte ocultar

   OpenCode disclosed on X on October 17 a security breach affecting 1.4% of its Console users, which it attributes to a "large-scale distillation attack". The affected accounts belong to users who had connected external providers. The company emailed affected users the following morning and says anyone who did not receive a notice was not impacted. That assurance is OpenCode's own assessment, not independently verified. OpenCode is working with Anthropic, OpenAI and Google on the response, but this does not imply their infrastructure was compromised. The incident is described as ongoing.

   Technical Details

   • The disclosure does not say how attackers gained access, which integration components were involved, or whether API keys, stored secrets or account data were exposed.
   • OpenCode has not explained the link between the breach and distillation activity. Claims of stolen API keys, automated model extraction, unauthorized inference requests or financial loss are unconfirmed.
   • No IOCs, attacker information, affected integration versions or total number of impacted accounts have been published.

   Remediation

   • The public statement does not specify customer actions. Affected customers should follow the instructions in the notification email.
   • Pending further disclosure, defenders using OpenCode with third-party providers may consider reviewing and rotating provider credentials and checking for anomalous usage. This is a precaution, since the article does not confirm key exposure.
3. techcrunch.com ↗ · pub. 19/10/2026 16:28 · coletado 19/10 17:55

   OpenCode Console breach exposes AI provider API keys of 1.4% of users, driving unauthorized charges

   ler a análise desta fonte ocultar

   OpenCode, an open-source AI coding agent, disclosed on Saturday that attackers broke into an older system overnight and affected 1.4% of users of its online platform, OpenCode Console. Some of those users store API keys for AI services there. The company called it a "large-scale distillation attack", but skeptics say it was a straightforward breach and that its use for distillation is unproven. Developers reported unauthorized charges on OpenAI, Anthropic and Google accounts, typically in the hundreds of dollars and in a few cases above $1,000. OpenCode says the incident is ongoing and has not explained how the attackers got in.

   Technical Details

   • The exposed keys were confined to OpenCode Console workspaces. According to co-founder Dax Raad, the open-source app and CLI were not affected, and those keys never reach OpenCode.
   • OpenCode has not disclosed the initial access method, how the keys were stored, or the full extent of misuse.
   • Leaked API keys can help users in countries with restricted access to American models generate the high volume of outputs distillation needs, but the article does not confirm this was the purpose.
   • Raad said attackers had been trying to break in nonstop for 48 hours, and the team ran AI defensive agents around the clock. Commercial AI models eventually refused to analyze the malicious code because it triggered their safety filters.
   • OpenCode later got access to OpenAI's Daybreak Blue program, which gives vetted users models less likely to refuse defensive security work. Hugging Face reported a similar problem in July.
   • The breach occurred the same night OpenCode made GLM-5.3-Flash free for users. The article draws no causal link.

   Remediation

   • Affected users were notified by email. Users who received no email were not impacted.
   • Affected users should revoke and replace their API keys directly with each AI provider.
   • Anthropic and Google blocked the keys they believed were exposed. OpenAI worked with OpenCode to restore access and refund customers for credits used in the attack. OpenCode says refunds for unauthorized charges are underway.
   • Users should monitor provider spend alerts and avoid storing long-lived provider keys in shared workspaces.
4. bleepingcomputer.com ↗ · pub. 19/10/2026 14:27 · coletado 19/10 17:53

   OpenCode breach exposes users' linked AI provider API keys during large-scale distillation attack, causing unauthorized charges

   ler a análise desta fonte ocultar

   The open-source AI coding agent OpenCode disclosed a breach tied to a "large-scale distillation attack" that exposed stored external-provider API keys for 1.4% of OpenCode Console users. Affected users had linked providers such as Anthropic, OpenAI and Google. Users reported unauthorized charges ranging from several hundred USD to more than $1,700 overnight, and Google suspended some Google Cloud projects for "abusive activity consistent with hijacked resources." OpenCode says the earliest possible key exposure was October 17, 2026, 00:30 UTC, that no other data appears to have been exposed, and that it is working with Google, OpenAI and Anthropic. The article does not state the root cause or the initial access vector.

   Technical Details

   • Co-founder Dax Raad said attackers targeted OpenCode systems for at least 48 hours using AI agents.
   • OpenCode's own investigation was initially hampered because the AI models it used refused requests due to built-in safeguards.
   • The situation reportedly stabilized after OpenCode began using OpenAI's Daybreak cybersecurity model for defensive work.
   • Affected users were notified by email; users who received no email were not impacted.
   • Stolen keys were abused for rogue usage billed to victims' provider accounts.

   Remediation

   • Revoke and rotate any API keys linked to the OpenCode Console, especially if an OpenCode notification email was received.
   • Review billing and usage on Anthropic, OpenAI and Google Cloud accounts for anomalies, and set spending limits and alerts.
   • Contact providers about suspended projects. OpenCode's notice mentions possible reimbursement for impacted users.
5. thehackernews.com ↗ · pub. 19/10/2026 03:07 · coletado 19/10 17:53 primeiro registro

   OpenCode Console legacy system breach may have exposed saved OpenAI, Anthropic and Google API keys of 1.4% of users

   ler a análise desta fonte ocultar

   An intruder reached a legacy system at OpenCode on the night of October 16, and the company says third-party AI provider keys saved in OpenCode Console "may have been exposed." About 1.4% of Console users, all with an outside provider linked, were notified by email on October 17 and told to revoke and replace their OpenAI, Anthropic or Google keys. Some users report unauthorized charges, including $281 on OpenAI and $168 on Anthropic (Colin Parsons) and $1,700 in total losses (Preston Zeller). OpenCode has not confirmed that any key was copied or used. The company calls the incident ongoing and "related to a large-scale distillation attack," but has not named anyone or explained the link. Co-founder Dax Raad said attackers were still probing its systems on October 18.

   Technical Details

   • Only keys pasted into the hosted Console are at risk. Keys stored locally by the OpenCode CLI and desktop apps (SQLite database) "never come to us" and are not involved.
   • Provider keys are bearer credentials: whoever holds a copy can run billable requests until the provider revokes it.
   • Deleting a key from Console does not revoke it, and a Console budget cannot cap abuse because Console only sees requests passing through its own gateway.
   • Unconfirmed user reports include about $400 of unauthorized Anthropic usage and about €200 of Google usage (via Notebookcheck and Dealroom).
   • Not disclosed: the legacy system's identity, how it was reached, when access began, how many keys it held, and how many users 1.4% represents.
   • Context: Anthropic said in September that distillation campaigns use fake accounts built on stolen cards, credentials and harvested API keys. Criminal markets also resell AI keys and tokens.

   Remediation

   • Revoke the key in the provider's dashboard (OpenAI, Anthropic, Google) and create a new one.
   • Update every application and script that used the old key.
   • Review provider usage and billing for requests you did not make, going back at least to October 16.
   • Set spend limits or alerts at the provider and give each tool its own key.