OpenCode breach exposes stored AI keys, runs up bills

By VK

Published 20 Oct 2026, 12:52 UTC

Reporting from TechCrunch

Attackers took AI provider keys saved in OpenCode Console, affecting 1.4% of Console users, and some saw unauthorized charges. Refunds are underway.

What it means for founders

Treat hosted key stores as a liability. Any dev tool that keeps your provider keys on its servers is one more place they can leak. Prefer tools that keep credentials on the developer's machine, and give each tool its own narrowly scoped key so one breach cannot drain your main account.
Set hard limits, not just alerts. At least one developer here learned something was wrong from spend alerts firing overnight, before any disclosure arrived. Where a provider supports spending caps, set them, keep prepaid balances low, and send alerts to someone who will act at night.
Rotate now if you used Console. Revoke and replace any key you ever saved there, provider by provider, then check usage logs for calls you did not make. Google points disputed charges to Cloud Billing support.
Put dev tools in your supply chain review. Coding agents, plugins and their dashboards hold valuable credentials, as Meta's Muse agent flaw also showed. Ask vendors where keys live and how fast they disclose, and watch whether OpenCode publishes a full account of how the older system was reached.

The story

OpenCode, which makes an open source coding agent for developers, said on Saturday, October 17, that attackers had breached its systems overnight and reached API keys some users had saved for outside AI providers. Its post on X put the impact at 1.4% of users of OpenCode Console, its web platform, and said every affected person had been emailed. The company tied the breach to what it called a large-scale distillation attack and said Anthropic, Google and OpenAI were helping it remediate.

How the stolen keys were used

One developer described spend alerts from OpenAI, Anthropic and Google all going off overnight, and other users said single accounts were billed several hundred dollars, with a few putting their totals above $1,000, TechCrunch reported. According to the outlet, the intruders got in through an older system and kept probing for 48 hours. Co-founder Dax Raad stressed that only Console was involved: keys entered in the open source agent itself stay off OpenCode's servers, so that side was untouched.

The model providers moved to contain the damage. Anthropic said it had revoked Claude keys it believed were affected. Google said it had blocked exposed Gemini keys and told users to make new ones in AI Studio and review their usage. OpenAI said it restored access for affected API customers and refunded credits drawn in the attack. Raad said OpenCode had contacted everyone hit and that refunds were underway.

Defenders ran into guardrails

Raad said the frontier models his team used to investigate helped for a while, then began refusing, and that things improved once OpenCode gained access to Daybreak Blue, OpenAI's program for vetted defensive security work. David Sacks, who co-chairs PCAST, the White House council of science and technology advisers, said on X that the episode showed how safety filters can backfire on defenders. Others, including Nathan Lambert, questioned why a key theft was labeled distillation at all.

What we don't know yet

How attackers reached the older system, and how Console stored keys.
The total charged across all accounts, and whether Anthropic and Google will refund in full.
Whether the keys actually fed model distillation. OpenCode says the incident is ongoing and has shared no evidence.