Your OpenCode Key May Be Out There, and the Bill Could Be Yours

Attackers broke into an older system run by the AI coding tool OpenCode, and the secret keys of 1.4% of its Console users may have been exposed. Some of those users now report unexpected charges from AI providers.

The story is still moving. Anyone who got no email was not affected, the company said. ^[1][2] In a statement reported on October 19, it said the incident was ongoing. ^[1]

OpenCode has not said how many people 1.4% is.

Why a key is worth stealing

An API key is a long, secret string of characters. Software shows it to an online service to prove it is allowed in. ^[3][4] Think of a hotel keycard that never asks who is holding it. Whoever presents the card gets the room.

OpenCode Console is where some customers keep the keys for outside AI providers. Its documentation says the service stores those credentials and uses them to send requests to the providers on the team's behalf. Workspace members can use the enabled models without ever seeing the key itself. ^[3]

That convenience is the risk. The providers, among them OpenAI, Anthropic and Google, bill the owner of the key for whatever is run with it. If a stranger holds a copy, the stranger's usage lands on the owner's bill.

OpenCode's email, as reported by BleepingComputer, said attackers had reached a legacy system that the company was preparing to decommission. It warned that third-party provider keys saved in users' workspaces may have been exposed. ^[2]

The company has not said how the keys were stored on that system, or how long the attackers had access.

What users are reporting

Users posted reports of unexpected spending on their provider accounts. BleepingComputer reported individual accounts of charges from several hundred dollars to as much as $1,700. It also reported that some Google Cloud projects were suspended after activity Google described as consistent with hijacked resources. ^[2]

These are user reports, not an audited total, and nobody has published a figure for all affected accounts.

The providers moved. According to TechCrunch, Anthropic and Google blocked keys they believed were exposed. OpenAI worked with OpenCode to restore access and refund customers for credits used in the attack. OpenCode said refunds for unauthorized charges were underway. ^[1]

Anthropic said it had revoked Claude API keys it believed were affected. It advised anyone who had saved a key in OpenCode to create a new one if they wanted to be extra careful. ^[1]

The boundary, and the explanation

Co-founder Dax Raad said the affected credentials were tied to Console, not to the open-source OpenCode app or its command-line tool. The keys, he said, did not come from the app itself. ^[1] So developers who run the free tool on their own machines and keep their keys elsewhere are outside the confirmed damage.

OpenCode also said the incident was related to a large-scale distillation attack. Distillation trains a smaller AI model on the answers of a more capable one. A group that wanted to copy a leading model's behavior cheaply would need a great many answers, and stolen keys would let someone pay for them with other people's money. ^[1][2]

That is OpenCode's account of the motive. The company has not publicly detailed how the breach happened or shown how the exposed keys were used, so the motive is not independently established. ^[1][2]

Raad described a company under siege. Attackers, he said, had been trying to break into its systems nonstop for 48 hours. The AI models his team used to analyze the malicious code began refusing some requests after their safety filters were triggered. ^[1][2]

The defenders were slowed by the guardrails of the same industry whose accounts were being drained. OpenCode later received access to OpenAI's Daybreak Blue program for defensive security work. ^[1]

What to check

The advice from OpenCode and the providers is the same. If you ever saved a provider key in OpenCode Console, do not wait for an email.

OpenCode told affected users to revoke and replace their keys directly with each provider. ^[1] Revoking kills the old key. A new key, issued by the provider, is not in the attackers' hands.

Then look at the usage and billing pages of each provider account the key touched. Unexpected spending is the sign, and it is what users have reported so far. ^[2] Teams that ran Google Cloud projects through the tool should check whether any were suspended. ^[2]

What is not known

The open questions are large. OpenCode has not said how the attackers entered the older system, how many keys were exposed, which providers or account types were involved, or how much unauthorized usage there was. Nor is it clear how many users have been refunded, or whether every affected key has been replaced. ^[1][2]

A hosted tool that holds keys for other companies' services turns a breach into a billing problem the moment it happens.

Watch for OpenCode's account of how the intruders got in, the number of keys it says were exposed, and whether it changes the way Console stores provider credentials.