OpenCode breach: why you should revoke your AI API keys today

OpenCode says an intruder reached a legacy system it was already in the process of shutting down on the night of October 16. The exposed data sat in OpenCode Console, the company’s optional hosted service. Console lets a team save one OpenAI, Anthropic or Google key in a shared workspace so that members can use those AI models without ever seeing the key itself.

The company emailed affected users on the morning of October 17 with the subject line “Action Required: Potential provider key breach.” OpenCode says 1.4% of Console users were affected, all of them people who had linked an outside AI provider. If you didn’t get that email, OpenCode says you weren’t affected.

OpenCode described the incident as “related to a large-scale distillation attack” and said it is working with Anthropic, OpenAI and Google to fix it. It hasn’t said how many people 1.4% represents, how the old system was reached, or when the unauthorized access started.

This is the most important distinction. The breach involves keys pasted into OpenCode Console, the web service, not the OpenCode app most developers run on their own computers.

• Possibly exposed: provider keys you saved in an OpenCode Console workspace.
• Not affected, according to OpenCode: keys added in the OpenCode command-line or desktop apps, which are stored locally on your own machine. Co-founder Dax Raad stressed that those keys never reach the company.

OpenCode’s own wording is that keys “may have been exposed.” It hasn’t confirmed that any key was copied or used. But users are reporting charges they didn’t make: one said their OpenAI key was used for $281 and their Anthropic key for $168, another put their losses at $1,700, and one Reddit user said Google usage reached about €200 before the project was suspended for abuse.

In AI, distillation normally means training a smaller model on a bigger model’s answers. The term is now also used for something shadier: rival labs quietly pulling huge numbers of answers out of a top AI model, through other people’s paid accounts, to train their own competing model. Anthropic has said these campaigns rely on networks of fake accounts built with stolen credit cards, login details and harvested API keys.

That would explain why the keys are valuable. A stolen key gives an attacker free, untraceable access to a top model, and the victim pays. It also explains why OpenCode is working with all three AI providers. Anthropic says it has already revoked Claude keys it believes were affected, while still advising anyone who saved a key in OpenCode to create a new one.

The attack isn’t over. On October 18, Raad said attackers had been hammering the company’s systems non-stop for two days, and added that his team ran into AI safety filters refusing to help while they investigated.

Here’s the detail many people miss: deleting a key from OpenCode Console does not cancel it. And a Console budget can’t cap misuse, because a thief using your key goes straight to the provider. You have to act at the provider.

1. Revoke the key at the source. Log in to your OpenAI, Anthropic or Google dashboard, delete the old key and create a new one.
2. Update everything that used it. Swap the new key into every app, script and tool, or they’ll stop working.
3. Check your usage and billing. Look for requests you didn’t make, going back to at least October 16. If you find any, contact the provider’s support with dates and amounts.
4. Set a spending limit or alert. AI providers generally let you cap spending or get alerts, so a stolen key can only do limited damage.
5. Use one key per tool. Separate keys make misuse easier to spot and quicker to shut off without breaking everything else.

OpenCode lets developers plug in keys from more than 75 AI providers and has grown fast, reportedly passing 150,000 stars on GitHub. That convenience has a cost: any service that stores several of your keys becomes a single place where a hacker can grab them all at once. It also isn’t OpenCode’s first security scare this year. A separate, critical flaw in older versions of the app was patched earlier in 2026. Treat any AI key like a credit card number: store as few copies as possible and set limits on what it can spend.