OpenCode says breach hit 1.4% of Console users

OpenCode, an open source AI coding agent, wrote on X: "We had a security breach last night related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users. We have notified them all this morning via email." The company said users who did not receive an email were not impacted. Co-founder Dax Raad said the open source app and command-line tool were not affected. "Note this is the OpenCode Console, not OpenCode itself, those keys never come to us," he wrote on X.

OpenCode Console is the hosted platform where some users store API keys for services including OpenAI, Anthropic and Google. Affected accounts were a subset of Console users who had linked external providers, OpenCode said. CPO Magazine reported OpenCode has about 16 million active monthly users. The 1.4% figure applies to Console users, not that wider base. Console stores credentials for connected providers and injects them into requests forwarded through its gateway, CPO Magazine reported. That design means a stolen key can be used at the account holder's expense until the provider revokes it.

OpenCode has not disclosed how attackers gained access to the older system, how keys were stored, or the full extent of any misuse. It also has not given a total for fraudulent charges. It has not named the threat actor. It has not said how many Console users had saved API keys in the service or linked an external provider. The company said the incident remains ongoing and that it is working with Anthropic, OpenAI and Google.

What users reported

Developers began posting spending alerts and unauthorised charges on Reddit and X overnight. One wrote: "I saw my Open AI, Anthropic, and Google AI spend alerts all fire off before going to bed wondering what was going on." TechCrunch reported that charges ran into the hundreds of dollars on individual accounts, and a few users described totals above $1,000. In a Reddit thread cited by Notebookcheck, one user reported $400 in unauthorised charges on an Anthropic account, while another said Google usage charges reached around €200 and their project was suspended for excessive abuse. CPO Magazine reported one case of charges up to $1,700.

Anthropic and Google blocked the API keys they believed had been exposed, TechCrunch reported. OpenAI said it worked with OpenCode to restore access and refunded credits its API customers lost in the attack. Raad said OpenCode's own refunds for unauthorised charges were already underway.

Why the distillation label is disputed

The company's label, a large-scale distillation attack, is disputed. Distillation in this context means querying frontier models at volume and using the answers to train or improve another model at a fraction of the cost. Leaked API keys can help users in countries with restricted access to American models generate the high volume of outputs needed for that process, TechCrunch reported. Operators in those countries can also route requests through intermediary services known as LLM gateways or proxy networks to obscure who they are. Skeptics called the framing an overstretch and said use for distillation remains unproven. CPO Magazine noted that no concrete evidence currently shows the incident was a distillation attack.

What affected users should do

OpenCode told affected users to revoke and replace their provider keys, update applications that use them and review recent usage for unexpected activity. The company also advised reviewing usage and billing for unfamiliar requests dating back to 16 October and setting spending limits. Deleting a key inside Console does not end an attacker's access. Users have to revoke it in the provider's dashboard.