OpenCode Console Breach Leaks Linked OpenAI, Anthropic and Google Keys

Key Takeaways

• OpenCode disclosed a breach of its Console platform that exposed stored third-party AI provider keys.
• About 1.4% of Console users who linked OpenAI, Anthropic, or Google accounts were affected.
• Victims reported unauthorized charges from several hundred dollars to more than $1,700 overnight.
• OpenCode described the attack as large-scale distillation, using stolen keys to query models.
• The open-source app and command-line tool were not affected.

Stored Keys Fueled Someone Else's Model Training

OpenCode, an open-source AI coding agent, said attackers broke into its hosted Console and took API keys users had linked for major model providers. As BleepingComputer reported, victims quickly saw unexpected bills, and some had cloud projects suspended for abusive activity.

What We Know

OpenCode announced the breach on October 17, 2026, and told affected users the earliest possible key exposure was 00:30 UTC that day. Co-founder Dax Raad said attackers had targeted the company's systems for at least 48 hours. The company called it a large-scale distillation attack affecting 1.4% of Console users who had connected external AI providers.

According to TechCrunch, Anthropic and Google blocked exposed keys, and OpenAI worked with OpenCode to restore access and refund credits. OpenCode said its own investigation stalled when AI models it used refused to analyze the malicious code, until it gained access to OpenAI's Daybreak program for defensive work. The company has not explained how attackers got in or how keys were stored.

What Happened

The Console let users store provider API keys so OpenCode could route model requests on their behalf. Attackers who reached that system obtained a ready-made pool of paid model access across three major providers. In a distillation attack, that access is used to send huge volumes of queries and collect outputs to train another model, with the victims paying for the compute.

This is a classic credential breach with an AI twist. The secrets were not passwords but model access keys, and the harm arrived as usage charges and provider enforcement actions rather than data theft. The case also shows how AI safety filters can slow incident response when defenders need to analyze malicious code.

Why It Matters

Developers and companies increasingly hand provider keys to third-party AI tools. Each tool becomes a concentration point for credentials, and a breach can turn into direct financial loss within hours. Provider suspensions can also disrupt legitimate projects that share the same keys.

The incident raises questions about how AI tooling vendors store secrets and disclose breaches. Affected users should revoke and replace keys with each provider and review billing for unexpected usage.

PointGuard AI Perspective

Every AI provider key is an identity that needs governance. PointGuard AI Agent Identity and Access Security replaces scattered long-lived keys with scoped, monitored access tied to each agent and user, so a single vendor breach does not hand out unrestricted model access.

PointGuard AI Discovery inventories the third-party AI tools and connected providers in use across an organization, revealing where keys have been shared. Combined with PointGuard AI Supply Chain Security, teams can assess the risk of AI vendors before trusting them with credentials. Responsible AI adoption means knowing which tools hold your keys and watching how those keys are used.

Incident Scorecard Details

Total AISSI Score: 7.1/10

Criticality: 7, Provider API keys grant paid model access and can link to wider cloud projects. AISSI weighting: 25%

Propagation: 6, Keys for three providers were exposed at once through one shared tool. AISSI weighting: 20%

Exploitability: 8, Confirmed abuse of stolen keys produced unauthorized charges. AISSI weighting: 15%

Supply Chain: 8, The breach occurred in a third-party AI tool trusted to hold provider keys. AISSI weighting: 15%

Business Impact: 7, Victims suffered financial losses and project suspensions, with refunds underway. AISSI weighting: 25%

Sources

Third-Party Sources

• BleepingComputer: OpenCode hack exposes API keys amid AI distillation attacks
• TechCrunch: Hackers hit AI coding tool OpenCode, running up charges on users' AI accounts

PointGuard AI Sources

• PointGuard AI Agent Identity and Access Security
• PointGuard AI Discovery
• PointGuard AI Supply Chain Security