OpenCode Says a Distillation Attack Exposed Stored Provider API Keys for 1.4% of Console Users

Overview

OpenCode, the open-source AI coding agent, has told a share of its hosted-service users to replace third-party AI provider keys after a security incident. According to The Hacker News, an intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the provider keys that users had saved in OpenCode Console. The affected group is 1.4% of Console users, all of whom have an outside provider linked, The Hacker News reported. BleepingComputer also reported that 1.4% of Console users were affected.

What We Know

• What Console is. Per The Hacker News, Console is OpenCode’s optional hosted service: a workspace saves its own OpenAI, Anthropic or Google key there, and Console uses that key to call the provider.
• Notification. The Hacker News reported that OpenCode emailed affected users on the morning of October 17 under the subject line “Action Required: Potential provider key breach.” and told them to revoke the keys with each provider and replace them. Users who did not receive the email were not affected, the outlet reported, citing a later OpenCode post on X.
• Scope of the CLI and desktop apps. The Hacker News reported that co-founder Dax Raad wrote on X that the breach involves “the OpenCode Console, not OpenCode itself,” and that keys stored on a user’s own machine “never come to us.”
• Company wording. OpenCode’s own language is that the keys “may have been exposed,” according to The Hacker News. The outlet reported that the company called the incident ongoing, said it was working with Anthropic, OpenAI and Google, and described the breach as “related to a large-scale distillation attack.” BleepingComputer likewise reported that OpenCode is working with Google, OpenAI and Anthropic.
• Ongoing attacks. On October 18, Raad wrote on X that attackers had been “non stop trying to attack our systems for the past 48 hours,” and that “a side effect is everything is getting hardened,” The Hacker News reported. BleepingComputer reported that Raad indicated the attackers used AI agents over roughly 48 hours.

User Reports of Losses

Some users say they have paid for usage they did not run. The Hacker News cited a Dealroom report that Colin Parsons wrote on X that his OpenAI key had been used for $281 and his Anthropic key for $168, and that Preston Zeller put his losses at $1,700. The outlet noted these are the users’ own accounts. BleepingComputer reported that users described unauthorized charges ranging from several hundred dollars to $1,700, and that OpenCode said it would explore reimbursement for affected users.

Guidance for Affected Users

The Hacker News reported that deleting a key from Console does not revoke it, so the key must be revoked in the provider’s own dashboard. The outlet’s article also lists reviewing usage and billing at the provider for requests the owner did not make, going back at least to October 16, and updating every application that used the old key.

What We Don’t Know

The Hacker News reported that OpenCode has not said when the unauthorized access began, and that the company has not said how the “distillation attack” connects to the key exposure, what the legacy system was, how it was reached, how many keys it held, or how many users 1.4% represents. It also noted that the company has not said that any key was copied or used.