OpenCode breach exposed provider keys, $1,700 charges overnight

OpenCode, the open-source AI coding agent, has told roughly 1.4% of its Console users that the API keys they stored for external model providers were exposed in a breach. Some of those users woke up to more than $1,700 in unauthorized charges, and Google suspended several projects after flagging “abusive activity consistent with hijacked resources.”

The exposed credentials were keys for Anthropic, OpenAI, and Google. OpenCode is model-agnostic: you link your own provider credentials to the Console, and the agent uses them to call whichever model you pick from a terminal, desktop app, or editor. Only users who had linked an external provider were affected. The maintainer said everyone impacted was emailed on Saturday morning, and that if you didn’t get an email you weren’t in the set.

The attack is what OpenCode calls a distillation attack. Distillation is ordinary machine learning: train a smaller, cheaper model on the outputs of a larger one so the small model inherits much of the big one’s behaviour. It turns hostile when the queries run at scale against a model someone else is paying for. With a stolen provider key, an attacker can push a huge volume of prompts through a frontier model, capture the responses as training data, and leave the victim holding the bill. That matches the user reports: charges from a few hundred dollars up to $1,700 overnight, and Google killing projects whose usage looked hijacked.

Co-founder Dax Raad said attackers had been working OpenCode’s systems for at least 48 hours using AI agents. The notification email puts the earliest possible key exposure at October 17, 2026, 00:30 UTC, and says no data beyond the keys themselves appears to have been exposed.

One part of the response is worth dwelling on. OpenCode said its own investigation of the attackers got blocked when the AI models it was using to analyse the incident started refusing requests, tripping their built-in safety guardrails. The defenders’ tooling declined to cooperate on a security investigation because the activity looked like something it was trained to refuse. Raad said things stabilised after OpenCode was approved on Saturday to use OpenAI’s Daybreak cybersecurity model for the defensive work.

If you store other people’s provider keys

The useful lesson for anyone building on this pattern is where the damage lands. OpenCode’s own data wasn’t the prize; the provider accounts were. A stored provider key is a bearer token with a credit line attached. Whoever holds it can spend until someone notices.

If you were an OpenCode Console user with a linked provider, rotate those keys now, whether or not you got an email, and check your provider billing for the window starting October 17. On the design side, the controls that would have capped this sit at the provider, not the agent: a separate key per integration instead of one shared key, hard spend limits and budget caps, and billing anomaly alerts that fire on a spike rather than at the end of a cycle. None of that prevents a key leak, but all of it bounds the cost of one.

OpenCode said it is working with Google, OpenAI, and Anthropic on the incident and raised the possibility of reimbursing affected users, though it has not shared further detail and did not respond to BleepingComputer’s questions.