OpenCode, the maker of a popular open-source AI coding agent, disclosed over the weekend that an intruder reached a legacy system on the night of October 16 and may have exposed API keys that users had stored in OpenCode Console, the company's optional hosted service. The company emailed affected users the next morning under the subject line "Action Required: Potential provider key breach," and said roughly 1.4% of Console users — everyone who had linked an outside AI provider — were affected.
Developers who use OpenCode to connect to OpenAI, Anthropic and Google's AI models quickly began reporting unexplained spending alerts. One user, Colin Parsons, said he was billed $281 in unauthorized OpenAI usage and $168 in Anthropic usage; another, Preston Zeller, reported losses of $1,700. Additional users described hundreds of dollars in unrecognized Anthropic charges and roughly €200 in Google usage, according to accounts gathered by The Hacker News. Anthropic and Google have since blocked the keys they believe were exposed, and OpenAI said it is restoring access and refunding customers for credits consumed in the attack.
A Breach Its Own Defenses Couldn't Fully Analyze
OpenCode has described the incident as related to a "large-scale distillation attack," though it has not explained the connection, and TechCrunch reports that security researchers are skeptical, suspecting a more conventional intrusion. Co-founder Dax Raad said attackers had been trying to break into OpenCode's systems continuously for 48 hours, adding that "a side effect is everything is getting hardened." In a detail that has drawn particular attention, OpenCode's own AI-assisted defenses reportedly stalled partway through the response because safety filters built into the underlying models blocked them from analyzing the malicious code, forcing the company to seek access to a program for vetted defensive-security use. The episode echoes a July incident at Hugging Face, in which commercial AI models similarly refused to help analyze an attack against the company that had deployed them.
What Affected Users Should Do
OpenCode has not disclosed what the legacy system was, how the intruder got in, or how many keys were ultimately exposed, and it continues to describe the incident as ongoing. The company is telling affected users to revoke and reissue API keys directly with each provider rather than relying on Console's own settings — deleting a key from Console does not revoke it with the provider, and a Console spending cap does not limit usage made outside Console's gateway. Security researchers are recommending that any developer who linked a provider key to OpenCode review billing activity back to October 16, set hard spend limits or alerts with each AI provider, and use a separate key for every tool rather than one shared credential.
