An OpenCode Console breach potentially exposed OpenAI, Anthropic and Google API keys belonging to 1.4% of Console users, potentially letting attackers run up bills on victims’ accounts. OpenCode has linked the breach to an alleged model distillation attack, harvesting frontier models’ outputs to train competing models.
The affected group is 1.4% of Console users, all of whom have an outside provider linked, and OpenCode has told them via email to revoke those keys with each provider and replace them.
The email went out on the morning of October 17 under the subject line “Action Required: Potential provider key breach.” Anyone who did not get one was not affected, OpenCode said in a post on X later that day.
The keys at risk are the ones pasted into Console. The OpenCode command-line and desktop apps keep provider keys added on the machine in a SQLite database there. The breach involves “the OpenCode Console, not OpenCode itself,” co-founder Dax Raad wrote in a reply on X, and those keys “never come to us.”
Yuval Elbar, Security Researcher, Cycode
“For anyone who saved a key in OpenCode Console, the immediate step is to revoke it directly with OpenAI, Anthropic or Google, since deleting it from Console does not revoke it. Then update anything that used the old key and review provider usage and billing back to at least October 16.
The alleged model distillation motive highlights why AI model API keys are such valuable targets, because attackers can run up compute costs on someone else’s account while harvesting outputs from frontier models to train another model.
The longer-term lesson applies to every organization, whether or not it uses OpenCode: visibility into the AI layer of development has to sit alongside traditional secrets management.
This is an important gap to focus on. Security teams need a live inventory of the AI coding tools, MCP servers and models developers have connected, and detect secrets wherever they surface across code, pipelines and collaboration tools. When a vendor breach notice like OpenCode’s arrives, teams must be able to quickly identify whether they’re exposed, which keys are involved and where those keys are reused.
Pair that visibility with a separate, scoped key for each tool and provider spending limits, and teams can contain the impact and rotate affected keys quickly, without having to hunt for credentials nobody tracked.”
Seeing as marching orders (as in revoking keys) are out there, I would do this now. As in right now.
Related
This entry was posted on October 20, 2026 at 1:49 pm and is filed under Commentary with tags OpenCode. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
OpenCode breach – AI keys targeted for model distillation
An OpenCode Console breach potentially exposed OpenAI, Anthropic and Google API keys belonging to 1.4% of Console users, potentially letting attackers run up bills on victims’ accounts. OpenCode has linked the breach to an alleged model distillation attack, harvesting frontier models’ outputs to train competing models.
The affected group is 1.4% of Console users, all of whom have an outside provider linked, and OpenCode has told them via email to revoke those keys with each provider and replace them.
The email went out on the morning of October 17 under the subject line “Action Required: Potential provider key breach.” Anyone who did not get one was not affected, OpenCode said in a post on X later that day.
The keys at risk are the ones pasted into Console. The OpenCode command-line and desktop apps keep provider keys added on the machine in a SQLite database there. The breach involves “the OpenCode Console, not OpenCode itself,” co-founder Dax Raad wrote in a reply on X, and those keys “never come to us.”
Yuval Elbar, Security Researcher, Cycode
“For anyone who saved a key in OpenCode Console, the immediate step is to revoke it directly with OpenAI, Anthropic or Google, since deleting it from Console does not revoke it. Then update anything that used the old key and review provider usage and billing back to at least October 16.
The alleged model distillation motive highlights why AI model API keys are such valuable targets, because attackers can run up compute costs on someone else’s account while harvesting outputs from frontier models to train another model.
The longer-term lesson applies to every organization, whether or not it uses OpenCode: visibility into the AI layer of development has to sit alongside traditional secrets management.
This is an important gap to focus on. Security teams need a live inventory of the AI coding tools, MCP servers and models developers have connected, and detect secrets wherever they surface across code, pipelines and collaboration tools. When a vendor breach notice like OpenCode’s arrives, teams must be able to quickly identify whether they’re exposed, which keys are involved and where those keys are reused.
Pair that visibility with a separate, scoped key for each tool and provider spending limits, and teams can contain the impact and rotate affected keys quickly, without having to hunt for credentials nobody tracked.”
Seeing as marching orders (as in revoking keys) are out there, I would do this now. As in right now.
Share this:
Like this:
Related
This entry was posted on October 20, 2026 at 1:49 pm and is filed under Commentary with tags OpenCode. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.