An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed third-party AI provider keys that users saved in OpenCode Console. The company says about 1.4% of Console users are affected, and some users have reported unauthorized charges on their provider accounts.
Legacy System Intrusion at OpenCode Console Put Saved Provider Keys at Risk
Console is the optional hosted service of the OpenCode AI coding tool where a workspace stores its own OpenAI, Anthropic or Google key, so team members can use models without seeing the key. The intrusion may have exposed keys stored there.
OpenCode’s wording is that keys “may have been exposed.” The company has not said that any key was copied or used. It also has not said what the legacy system was, how the intruder reached it or how many users 1.4% represents.
Who Was Notified and What OpenCode Told Them
The affected group is the 1.4% of Console users who have an outside provider linked. OpenCode emailed them on the morning of October 17 under the subject line “Action Required: Potential provider key breach,” telling them to revoke and replace their keys with each provider. Users who received no email were not affected.
OpenCode’s post that day called the incident ongoing and said the company is working with Anthropic, OpenAI and Google. It linked the incident to “a large-scale distillation attack” but did not explain the connection.
Command-Line and Desktop Apps Not Involved, Co-Founder Says
The OpenCode command-line and desktop apps are said not to be involved. Keys added locally stay in a local SQLite database and “never come to us,” according to co-founder Dax Raad. The exposure is therefore limited to keys saved in the hosted Console service.
On October 18, Raad said attackers had been “non stop trying to attack our systems for the past 48 hours.” He said the systems are being hardened, and the company described the incident as ongoing.
Why Deleting a Key From Console Does Not Revoke It
Deleting a key from Console does not revoke it. The key remains valid at the provider until the owner revokes it there. A Console budget also cannot cap usage, because Console only sees requests passing through its own gateway. Anyone holding a copy of a key can send requests directly to the provider without touching Console.
A provider key is a bearer credential: whoever holds a copy can run billable requests on the owner’s account until it is revoked. That is why OpenCode’s instructions to affected users focus on revocation at each provider instead of removal inside Console.
User-Reported Losses Range From Hundreds to About $1,700
Some users report unauthorized charges. One says $281 on OpenAI and $168 on Anthropic. Another reports about $1,700 in losses, and a Reddit user claimed $400 on Anthropic.
These are user claims, and OpenCode has not confirmed that the charges came from keys exposed in the breach. The exposure count remains undisclosed, so the total scale of any misuse cannot be established from the information available.
October 16 Intrusion to October 18 Hardening: How OpenCode Responded
The intruder reached the legacy system on the night of October 16. Notification emails went out the next morning, and an X post that day said the incident was ongoing. On October 18, Raad said attack attempts continued and systems were being hardened.
Open Questions for OpenCode and Its Users
Several details remain unexplained. OpenCode has not identified the legacy system, described how it was reached or disclosed how many accounts the 1.4% figure covers. It also has not explained how the incident relates to the “large-scale distillation attack” it mentioned.
For the AI providers named in the notification, the incident adds a pathway they do not control: a customer’s key stored with a third-party hosted service. OpenCode says it is coordinating with Anthropic, OpenAI and Google. The company’s next update would be expected to address how many keys were exposed and whether any were used, the two facts that determine whether the user-reported charges trace to the breach.
