OpenCode Console Breach Exposes Stored AI API Keys: What Engineering and IT Teams Should Do Now

OpenCode is an open-source AI coding agent. According to BleepingComputer, the company announced the incident on Saturday, October 17, and described it as a large-scale distillation attack, a technique that generates large volumes of model output. TechCrunch reported on October 19 that attackers got into an older system behind the OpenCode Console, where some users store API keys for AI services.

This summary is based on those two reports and OpenCode's own statements as relayed by them. The company has not published full technical details, so some facts below may change. The project is available from opencode.ai.

What Happened

Attackers reached stored API keys that OpenCode Console users had linked to AI providers, and some of those keys were then used to run up charges. OpenCode says about 1.4% of Console users were affected and that it notified them by email.

• Timeline: BleepingComputer reports the earliest possible key exposure as October 17, 2026 at 00:30 UTC, and OpenCode says attackers had been pressing its systems for at least 48 hours.
• Scope: users who received no email were not affected, according to OpenCode. The open-source app and command-line tool were not affected, per co-founder Dax Raad as quoted by TechCrunch, because the exposed keys were limited to the Console.
• Impact: reports describe unauthorized charges from several hundred dollars up to more than $1,000 for some developers.
• Providers: TechCrunch says Anthropic and Google blocked keys believed to be exposed and that OpenAI said it would refund credits used in the attack. BleepingComputer reports Google suspended some users’ projects after flagging abusive activity.

What Is Still Unclear

OpenCode has not said how attackers got in, how keys were stored or how much misuse occurred. Outside observers quoted by TechCrunch questioned whether distillation was the real goal, so the label should be treated as the company's characterization.

• Whether keys were encrypted at rest and how the attackers obtained usable values.
• The exact reimbursement terms, which differ between the two reports.
• Whether the incident is fully contained. TechCrunch says OpenCode described it as ongoing at publication.

Why It Matters for B2B Teams

The incident shows that a developer tool holding provider keys becomes part of your credential attack surface. A leaked AI key can create direct cost, expose prompts and data sent to the provider, and trigger account suspensions that interrupt production workloads.

• Financial exposure: AI usage is billed per token, so stolen keys convert quickly into cost.
• Operational risk: provider-side suspensions can disable projects that other systems rely on.
• Shadow adoption: engineers often connect personal or shared keys to new tools without a security review.
• Detection gaps: unfamiliar AI spend rarely triggers the same alerts as unusual cloud infrastructure spend.

What to Do Now

Revoke and replace any provider key ever stored in OpenCode Console, directly with each provider, then check billing and usage dashboards for activity you cannot explain. These steps are quick and limit further loss even if you never received an email.

• Rotate: revoke the old Anthropic, OpenAI, Google or other provider keys and issue replacements at the provider, not through the tool.
• Cap spend: set hard budgets and usage alerts on every AI provider account.
• Scope keys: use separate keys per tool and environment, with the narrowest permissions and model access available.
• Inventory tools: list which AI coding tools your engineers use and where keys are stored.
• Centralize secrets: keep keys in a managed vault rather than in third-party consoles, and rotate them on a schedule. NIST’s SP 800-57 Part 1 covers key lifecycle practices.
• Review the vendor: ask AI tool vendors how credentials are stored, encrypted and monitored before approving them.

Related Software Categories

This incident touches credential storage, API governance and AI development tooling, so buyers reviewing their controls can start with three SaaSPodium categories. Teams can compare vendors in SaaSPodium's Encryption Key Management Software, API Management Software and AI Code Generators Software categories, and enforce least privilege with Privileged Access Management (PAM) Software. For another credential-related supply chain incident this week, read our report on the ConnectWise Cloud Backup suspension.

Frequently Asked Questions

How do I know if my OpenCode keys were exposed?
OpenCode says it emailed affected Console users, and anyone without an email was reportedly not affected. Even so, review usage and billing for every AI provider key you ever stored in the Console and rotate those keys directly with each provider.

Should we stop using AI coding tools after this incident?
Not necessarily. Treat AI coding tools like any other vendor that holds credentials. Prefer tools that never store long-lived provider keys, use scoped keys with spend limits, and require a security review before engineers connect company accounts.

What is the fastest way to limit damage from a leaked AI API key?
Revoke the key at the provider, issue a new one with the narrowest scope available, set a hard spending cap and usage alerts, then review recent requests for unfamiliar models, regions or volumes. Document the timeline for your incident record.