OpenCode Console breach: Affected users must revoke their OpenAI, Anthropic and Google API keys
OpenCode, the open-source AI coding agent increasingly used by developers as an alternative to Claude Code and Cursor, announced on Saturday, October 17, 2026, that attackers had broken into a legacy system overnight. The incident affected 1.4 percent of users of OpenCode Console — the hosted platform where some users store their API keys with OpenAI, Anthropic and Google. Anyone who received the email "Action Required: Potential provider key breach" on Saturday morning is being asked to revoke their keys and create new ones, directly with each provider.
What happened — and what was not affected
Only Console was affected. OpenCode describes the intrusion itself as an attack on a legacy system that was already in the process of being decommissioned — raising questions about how well credentials were protected in older infrastructure. Dax Raad stressed on X that the open-source app and the command-line tool were untouched: "Note this is the OpenCode Console, not OpenCode itself, those keys never come to us," he wrote, according to TechCrunch.
That means developers who only use the open-source tool locally, and who never entered API keys into Console, are not affected. OpenCode says that anyone who did not receive the notification email on October 17 was not affected.
A "distillation attack" — a contested framing
In its X post on October 17, OpenCode described the breach as related to a large-scale "distillation attack" that affected 1.4 percent of Console users, and said all affected users had been notified by email that morning.
The company has not, however, explained what the "distillation attack" involved or how it was supposedly carried out. TechCrunch notes that leaked API keys could theoretically help actors in countries with limited access to American models generate the large datasets needed for distillation — the process of training a smaller model on the output of a larger one. But skeptics, whom TechCrunch references without naming, call the framing an overstatement: they believe the incident was a straightforward break-in, and that any use for distillation is unproven. So far there is no documentation confirming or refuting the company's interpretation.
The providers respond
Reactions from the model providers came quickly:
- Anthropic said, through Member of Technical Staff Lydia Hallie, that it had worked with OpenCode and revoked Claude API keys believed to be affected. She encouraged users who had stored a key in OpenCode to create a new one if they wanted to be extra careful, according to IBTimes Singapore.
- Google also blocked API keys believed to have been exposed.
- OpenAI said it was working with OpenCode on restoring access and refunding API customers for credits used in the attack. OpenCode says refunds for unauthorized charges are underway.
Users report charges
Overnight, developers began posting usage alerts and unauthorized charges on Reddit and X, TechCrunch reports. Several saw spending alerts from OpenAI, Anthropic and Google fire off at the same time.
The specific figures circulating are individual claims that neither AIMag nor OpenCode has verified:
- Colin Parsons wrote on X that his OpenAI key had been used for $281 and his Anthropic key for $168.
- Preston Zeller estimated his losses at $1,700.
- On Reddit, one user claimed roughly $400 in unauthorized use on an Anthropic account, and another roughly €200 in Google usage, before the project was suspended.
The reports are known via The Hacker News. There is still no aggregate figure for total losses.
Why leaked API keys are hard to stop
An API key is what is known as a bearer credential: whoever holds the key can use it, until it is revoked with the provider. This has two practical consequences, as explained by The Hacker News.
First, deleting a key from Console does not help. The deletion only removes the entry in OpenCode's system — the key remains valid with OpenAI, Anthropic or Google until the user revokes it in the provider's own interface.
Second, Console budgets cannot stop the misuse. Budgets in Console only see requests that go through OpenCode's own gateway. When an attacker uses the key directly against the provider, the usage is invisible to the budgeting system.
That is why it is critical that affected users revoke and replace their keys directly with each provider — not just clean up in Console. Safeguard, a security company working on software supply chain security, advised users to identify all relevant keys, create replacements, update dependent applications, and then revoke the originals.
The incident is ongoing
OpenCode itself describes the matter as an ongoing incident. The company has not said how the attackers gained access to the legacy system, when the unauthorized access began, how many keys the system held, or how many users 1.4 percent corresponds to. The company's own wording is that the keys "may have been exposed" — it is not confirmed that any key was actually copied or used.
Raad wrote on X on October 18 that attackers had been attempting to breach the company's systems continuously for 48 hours, and that a side effect was that everything was getting hardened, according to The Hacker News.
One side effect of the incident is worth noting: Raad said the AI models the team used to analyze the attack began refusing due to safety filters. OpenCode later gained access to OpenAI's Daybreak Blue program, which gives vetted users models that are less restrained on defensive security tasks. According to Raad, the access improved the team's ability to investigate the attack — a concrete example of the debate over whether AI safety measures can hamper defense against real attacks.
What you should do — and what remains unresolved
If you received the email "Action Required: Potential provider key breach" on Saturday, October 17: Identify all of your keys with OpenAI, Anthropic and Google, create new ones, update the applications that use them, and then revoke the old ones — with each provider. If you did not receive the email, OpenCode says you were not affected.
Several open questions remain: whether keys were actually copied or used, what lies behind the distillation attack claim, how the attackers got in, and what total losses amount to. With the providers' measures only just in place and refunds still underway, the available basis is still shifting.
Sources: TechCrunch, The Hacker News, IBTimes Singapore, Arabian Post via MSN