OpenCode Console Breach: Stored OpenAI, Anthropic and Google Keys May Be Exposed

OpenCode has warned a slice of its hosted Console users that the third-party AI provider keys they saved in the service may have been exposed after an intruder got into a legacy system on the night of October 16, 2026. If your team pasted an OpenAI, Anthropic or Google key into OpenCode Console, treat it as compromised and rotate it now.

What happened

OpenCode Console is the project's optional hosted service. A workspace stores a provider key there and Console uses it to call the model on the team's behalf, so individual members never handle the key.

According to the company:

• An intruder reached a legacy system on October 16. OpenCode has not said what that system was, how it was reached, or when the unauthorized access first started.
• About 1.4% of Console users who had an outside provider linked are affected. They got an email on October 17 titled "Action Required: Potential provider key breach." Users who did not get the email are not affected.
• Only keys stored in Console are in scope. The OpenCode CLI and desktop apps keep keys in a local SQLite database, and those keys never reach OpenCode's servers.
• OpenCode's wording is that keys "may have been exposed." It has not confirmed that any key was copied or used.

OpenCode called the incident ongoing. It says it is working with Anthropic, OpenAI and Google, and it described the breach as "related to a large-scale distillation attack." It has not explained that link or named anyone responsible. Attacks on its infrastructure were still happening on October 18.

Why it matters

A provider API key is a bearer credential: anyone holding a copy can run billable requests against the owner's account until the provider revokes it. Two details make this worse:

• Deleting the key from Console does nothing. The copy stays valid at the provider.
• Console budgets don't help. They only cap traffic that goes through Console's own gateway, not requests made with a stolen key directly.

Some users have already reported charges they say they didn't run, from a few hundred dollars up to about $1,700. These are users' own accounts and haven't been independently verified. The distillation angle also matters. That term covers campaigns that pull huge numbers of answers out of a model to train a rival one, often through networks of fake or hijacked accounts. Harvested AI keys are useful fuel for that, and they are also resold on criminal markets.

What to do

1. Revoke and reissue every provider key that was saved in an OpenCode Console workspace. Do this from the OpenAI, Anthropic or Google dashboard, not in Console.
2. Update every app, script and CI secret that used the old key.
3. Review usage and billing at each provider going back to at least October 16, and flag anything you can't account for. The start of the access is still unknown.
4. Set spend limits and alerts at the provider level.
5. Use one key per tool or integration. A leaked key then has a smaller blast radius and is easier to trace.
6. List every third-party service that holds your credentials (AI gateways, CI/CD, monitoring) and decide which ones really need long-lived keys.

Rotation fixes the keys you know about. Keys that leak quietly need watching too. Our Deep/Dark Web monitoring looks for an organization's credentials and API keys showing up on paste sites, leak channels and criminal marketplaces. That gives teams the chance to revoke a key before the bill arrives.

Originally reported by The Hacker News. Summary and analysis by the 4Tify Team.