OpenCode Console breach may have exposed saved AI provider keys
The OpenCode Console breach may have exposed the OpenAI, Anthropic and Google API keys that some users saved in the service, according to The Hacker News. OpenCode says an intruder reached a legacy system on the night of October 16, and it has told affected users by email to revoke and replace their keys. The company has said the keys “may have been exposed”, not that they were copied.
What we know
Console is OpenCode’s optional hosted service. A workspace saves its own provider key there, and Console uses it to call OpenAI, Anthropic or Google on the team’s behalf, so members never see the key.
- The intruder reached a legacy system on the night of October 16.
- OpenCode emailed affected users on the morning of October 17 with the subject line “Action Required: Potential provider key breach.”
- Later that day, a post on X said anyone who did not get the email was not affected.
- The same post called the incident ongoing and said OpenCode was working with Anthropic, OpenAI and Google.
- The company described the breach as “related to a large-scale distillation attack” but has not explained the link.
Co-founder Dax Raad wrote on X that the breach involves the Console, not OpenCode itself, and that keys added in the command-line and desktop apps “never come to us.” Those apps keep keys in a local SQLite database on the user’s machine.
Who is affected
OpenCode says the affected group is 1.4% of Console users, all of whom have an outside provider linked. The number of users that represents has not been disclosed, and neither has the number of keys the legacy system held.
Only keys pasted into a Console workspace are at risk. Keys stored locally by the command-line or desktop apps are not part of this incident, per the company.
Why this matters
Analysis: a provider key is a bearer credential. Whoever holds a copy can run billable requests against the owner’s account until the provider revokes it. Two details make this harder to contain than a typical password leak:
- Deleting the key from Console does not revoke it at the provider.
- A Console budget cannot cap misuse, because Console only sees requests that pass through its own gateway.
Teams that shared one key across several tools will also struggle to tell legitimate usage from abuse, which is why per-tool keys help.
What has not been confirmed
- OpenCode has not said when the unauthorized access began.
- It has not said what the legacy system was or how it was reached.
- It has not named anyone responsible or said how the incident connects to the distillation attack it mentions.
- It has not said any key was actually copied or used.
Some users report charges they did not make. Dealroom cited Colin Parsons on X saying his OpenAI key was used for $281 and his Anthropic key for $168, and Preston Zeller putting his losses at $1,700. Notebookcheck reported a Reddit user claiming $400 of unauthorized Anthropic usage and another claiming about €200 of Google usage. These are the users’ own accounts and are not confirmed by OpenCode or the providers.
What to do
- Check whether you received the “Action Required” email. If you saved a provider key in Console, treat it as exposed even if you are unsure.
- Revoke the key in the provider’s own dashboard (OpenAI, Anthropic or Google) and create a new one. Deleting it from Console is not enough.
- Update every application and script that used the old key.
- Review usage and billing at each provider for requests you did not make, going back at least to October 16. Contact the provider about any charges you did not authorize.
- Set a spend limit or alert at the provider, and give each tool its own key so a copied key does less damage and is easier to trace.
- Security teams: inventory where AI provider keys live, including hosted gateways, and add provider usage anomalies to your detection and billing alerts.
