VULNpocalypse
HighBreach / campaignMonitoring

OpenCode Console breach: OpenAI, Anthropic and Google keys stored in workspaces may have been exposed

An intruder reached an OpenCode legacy system and may have exposed provider keys saved in OpenCode Console. Revoke those keys at OpenAI, Anthropic or Google.

Published
Updated
Exploitation
Yes. Users reported unauthorized OpenAI, Anthropic and Google charges, from a few hundred dollars to about $1,700

What happened

OpenCode is an open-source AI coding agent. It also runs OpenCode Console, an optional hosted service where a workspace owner can store a provider key once and let team members use it through OpenCode’s gateway without seeing the key. Console docs say it “stores the credential and serves each provider through its gateway” (OpenCode docs).

  • 16 October 2026, night: an intruder reached what OpenCode called a “legacy system”. OpenCode has not said when access began (The Hacker News). OpenCode’s email to users gives 00:30 UTC on 17 October as the earliest possible exposure of keys (BleepingComputer).
  • 17 October, morning: OpenCode emailed affected users under the subject “Action Required: Potential provider key breach”, then posted on X that the breach was “related to a large-scale distillation attack” and affected 1.4% of OpenCode Console users. Only users with an external provider linked were affected, and OpenCode said “If you did not get an email, you were not impacted” (BleepingComputer). It said it was working with Anthropic, OpenAI and Google (The Hacker News).
  • 18 October: co-founder Dax Raad said attackers had been trying to get in “non stop” for 48 hours and that they used AI agents. He also said the defensive investigation stalled when the AI models OpenCode used refused security requests, and that OpenAI’s Daybreak model, approved for OpenCode that day, helped stabilise things (BleepingComputer).

What was exposed. Keys that workspace owners pasted into Console for OpenAI, Anthropic or Google “may have been exposed”. Raad said the incident involves “the OpenCode Console, not OpenCode itself”, and that keys added locally to the CLI or desktop app “never come to us” (The Hacker News). The email says no other data appears to have been exposed (BleepingComputer).

What is not disclosed: what the legacy system was, how the intruder reached it, how many keys it held, how many people 1.4% represents, and how the distillation activity connects to the breach (The Hacker News). OpenCode has not published a post-mortem as of 2 November 2026.

Abuse. Individual users reported charges of about $281 on OpenAI and $168 on Anthropic, about $400 of Anthropic usage, about 200 euros of Google usage, and up to about $1,700 overnight. These are user reports, not verified totals (The Hacker News). Some users said Google suspended their projects for “abusive activity consistent with hijacked resources”. OpenCode’s message mentioned possible reimbursement (BleepingComputer).

OpenCode is one of nine platforms in Wiz’s “Black October” count (Wiz); see our Black October roundup for the wider pattern. This incident is separate from the OpenCode MCP sign-in flaw fixed in 1.18.33, covered in MCP flaws in 2026.

Am I affected?

You are in scope only if you used OpenCode Console and an owner or admin connected a provider under the Providers tab (OpenCode docs). OpenCode says the users at risk got the email; search your inbox, and your workspace admins’ inboxes, for the subject line above.

  • Local-only use is not affected. If you only ran /connect in the CLI or desktop app with your own key, that key stayed on your machine (The Hacker News). opencode auth list shows which credentials the local install holds (OpenCode docs).
  • Console pay-as-you-go keys are a different thing. The incident is about your third-party provider keys stored in Console, not the OpenCode API key you get from Console.
  • Look for abuse from 16 October onward in each provider’s usage view: the OpenAI usage dashboard, the Anthropic Console usage and cost pages, and Google Cloud billing reports for the project that issued the Gemini key. Unfamiliar models, overnight spikes and Google “hijacked resources” suspension notices are the signs users reported.

What to do now

  1. Revoke the stored key at the provider, then create a new one. Deleting it from Console does not revoke it, and a Console budget does not cap spending made with the key outside Console’s gateway (The Hacker News).
  2. Put the new key back the safe way. In Console, click the credential on the provider page to replace it, rather than removing the provider (OpenCode docs). Update every other app or script that shared the old key.
  3. Give Console its own key. If the same Anthropic or OpenAI key also ran production workloads, split it: one key per tool, so the next revocation does not take production down.
  4. Set a hard spend limit or alert at each provider, since the gateway budget only covers Console traffic.
  5. Dispute and document charges. Collect the provider’s usage export for 16 October onward, report the unauthorized use to the provider, and ask OpenCode about the reimbursement its email mentioned (BleepingComputer). If Google suspended your project, its appeal will need the same evidence.

Sources