OpenCode Console breach exposed stored provider API keys

On the night of October 16, an intruder reached a legacy system at OpenCode and may have exposed the OpenAI, Anthropic, and Google API keys that users had saved in OpenCode Console. The company emailed the affected group the next morning under the subject line “Action Required: Potential provider key breach.” That group is 1.4% of Console users, all of them with an outside provider key linked. OpenCode said anyone who did not get the email was not affected.

Console is the part that matters here. It is OpenCode’s optional hosted service: a workspace pastes its own provider key into Console, and Console then uses that key to call OpenAI, Anthropic, or Google on behalf of the team, so members use the models without ever seeing the key. Keys added through the OpenCode command-line or desktop apps live in a local SQLite database on the machine and never reach OpenCode. Co-founder Dax Raad put it plainly: the breach involves “the OpenCode Console, not OpenCode itself,” and the CLI and desktop keys “never come to us.” If your key only ever sat on your own machine, it was not in scope.

A provider key is a bearer credential. Whoever holds a copy can run billable requests against the owner’s account until the provider revokes it. Two consequences follow that users keep tripping over. Deleting the key from Console does not revoke it, so the copy an attacker took still works. And a Console spend budget cannot cap the damage, because Console only sees requests that pass through its own gateway. A stolen key called directly against the provider never touches Console’s accounting.

Users are already paying for this. Dealroom reported that Colin Parsons wrote on X that his OpenAI key had been billed $281 and his Anthropic key $168, and that Preston Zeller put his losses at $1,700. Notebookcheck reported a Reddit user’s claim of $400 of unauthorized Anthropic usage and another’s of roughly €200 on Google, with the project then suspended. Those figures come from the users’ own provider accounts. OpenCode’s own wording stays at “may have been exposed”; it has not confirmed that any key was copied or used.

If you got the email, the response is the standard one for a leaked bearer token, and the order matters. Revoke the key in the provider’s own dashboard first and issue a new one, rather than just removing it from Console. Update every application and script that used the old key. Then review usage and billing at the provider for requests you did not make, going back at least to October 16. OpenCode has not said when the access actually began, so check from there and be ready to go further back. Going forward, set a spend limit and an alert at the provider itself, and give each tool its own key so a single copied credential does less damage and is easier to trace.

OpenCode’s October 17 post called the incident ongoing, said the company was working with Anthropic, OpenAI, and Google, and described the breach as “related to a large-scale distillation attack.” It did not explain the connection, name anyone, or say what the legacy system was, how it was reached, how many keys it held, or how many users 1.4% represents. Distillation is the providers’ term for campaigns that pull a model’s answers in bulk to train a competitor. Anthropic said in September that the operators behind such campaigns reach its models through networks of fake accounts built on stolen credit cards, stolen logins, and harvested API keys. A pile of working provider keys is useful fuel for exactly that, and the same keys resell on criminal markets to anyone who wants to run up someone else’s bill.

The incident has not closed. Raad wrote on October 18 that attackers had been “non stop trying to attack our systems for the past 48 hours,” with the upside that “a side effect is everything is getting hardened.” Treat any key that lived in Console as compromised until you have rotated it at the provider.

---

Contains a referral link.

See also: NordVPN for tunneled traffic when operating outside controlled networks.

---

#ad Contains an affiliate link.