# OpenCode Console breach: what happened and what to do

URL: https://infro.io/blog/opencode-console-breach-what-happened
Author: INFRO Editorial (https://infro.io/blog/editorial)
Publisher: INFRO
Published: 2026-10-21
Last modified: 2026-10-21
Last reviewed: 2026-10-21 (next review due 2026-10-28)
Topic: Security and governance
Format: Analysis

> OpenCode said on 17 October 2026 that a breach related to a large-scale distillation attack affected 1.4% of OpenCode Console users, those with external AI providers linked, and that provider keys saved in a workspace may have been exposed. The root cause is unpublished and the incident is ongoing. If you linked an OpenAI, Anthropic or Google key to the Console, create a scoped replacement, revoke the old key at the provider, and review provider usage from 16 October onward, whether or not you received the email.

Key takeaways:
- OpenCode says 1.4% of Console users were affected: those with external AI providers linked. Provider keys saved in a workspace may have been exposed.
- The root cause is unpublished and the incident is ongoing; treat every detail beyond OpenCode's own statements as reported, not confirmed.
- If you ever linked a provider key to the Console, replace it with a scoped key, revoke the old one at the provider, and review usage from 16 October onward.
- A platform that stores your provider keys cannot protect a key that has left it: the backstops are provider-side spend limits, scoping and revocation.
- Ask every tool that holds your provider keys the same questions, including INFRO.

**What happened in the OpenCode Console breach?** On 17 October 2026, OpenCode said it had a security breach the previous night, "related to a large scale distillation attack", that affected 1.4% of OpenCode Console users: those who had external AI providers linked[1]. Its email to those users said provider keys saved in a workspace "may have been exposed"[2]. The company is working with Anthropic, OpenAI and Google, has published no root cause, and describes the incident as ongoing.

If you ever linked a provider key to the Console, the short answer is: create a scoped replacement key, revoke the old one at the provider, and read your provider usage from 16 October onward. The rest of this page separates what OpenCode has confirmed from what has only been reported, explains where distillation fits, and turns the incident into questions worth asking any tool that stores your provider keys, including ours.

> **Note: This is an ongoing incident**
> Written on 21 October 2026. OpenCode may publish more, and some details below may change. This page is reviewed weekly while the incident is open, and each change will be dated in its revision notes.

## What OpenCode has said

These are the company's own words, from its public statement and the notification email that recipients made public.

| Statement | Where it comes from |
| --- | --- |
| A security breach "last night" related to "a large scale distillation attack" | OpenCode's public statement, quoted by BleepingComputer[1] |
| 1.4% of OpenCode Console users were impacted, a subset who had external providers linked | Same statement[1] |
| Affected users were emailed; "If you did not get an email you were not impacted" | Same statement[1] |
| Unauthorized access to "a legacy system that we were in the process of decommissioning" | The notification email, quoted by Infosecurity Magazine[2] |
| "third party provider keys (e.g. OpenAI, Anthropic) saved in your workspace may have been exposed" | The notification email, quoted by Infosecurity Magazine[2] |
| The earliest possible key exposure was 17 October 2026, 00:30 UTC | The notification email, as reported by BleepingComputer[1] |
| The incident is ongoing; OpenCode is working with Anthropic, OpenAI and Google | OpenCode's public statement[1] |

According to Infosecurity Magazine, the Console stores each workspace's provider credentials and uses them to authenticate requests, so team members do not see the underlying keys[2]. A co-founder said on X that the breach involved the Console only, not the OpenCode coding agent itself[2].

## What has been reported, not confirmed

Several details come from users or from interviews and have not been confirmed by OpenCode in a published account:

- **Unauthorized charges.** Users reported overnight charges ranging from several hundred US dollars to more than $1,700[1]. These are individual reports, not a confirmed total.
- **Suspended cloud projects.** Some users said Google suspended their projects after flagging "abusive activity consistent with hijacked resources"[1].
- **AI agents on both sides.** BleepingComputer reported co-founder Dax Raad saying attackers had targeted OpenCode's systems for at least 48 hours using AI agents, and that the models OpenCode used for its investigation refused some requests because of their safeguards[1].
- **Reimbursement.** BleepingComputer reported that OpenCode's message to impacted users mentioned the possibility of reimbursement[1]. No terms have been published.

## What nobody has said yet

As of 21 October, OpenCode has not published:

1. How the legacy system was reached, or how long access lasted.
2. How keys were stored on that system, and whether they were readable there.
3. How many keys were exposed, and whether any were confirmed used by the attacker.
4. How the breach and the distillation attack connect.
5. Whether the scope (1.4%, linked providers only) could still change.

Until those are answered, the safe reading is the vendor's own: keys saved in an affected workspace may have been exposed, so treat them as exposed.

## Where distillation fits

Distillation means training a model on the outputs of a stronger one. It is a standard technique when a lab distills its own models; it becomes an attack when another party extracts a model's capabilities through its API without permission. In February 2026, Anthropic said three labs had generated more than 16 million exchanges with Claude through roughly 24,000 fraudulent accounts, using proxy networks to get around its access rules[3]. In September, a joint advisory from CISA, the NSA and the FBI named six China-based companies and described the infrastructure such campaigns rely on: accounts not registered to legitimate users, gray-market API proxies, aggregators, relays and pooled accounts[4].

That is the background against which a store of working provider keys becomes valuable. Each key comes with someone else's identity, payment method, rate limits and account history, which is exactly what a campaign needs to look like ordinary traffic. OpenCode has not said that exposed keys were used for distillation, and this article does not claim it. What the background explains is why keys to frontier-model accounts are worth stealing in bulk in 2026, and why a leaked key can now produce a large bill overnight. [What is an AI distillation attack](https://infro.io/blog/what-is-ai-distillation-attack) covers the technique in depth.

## If you linked a provider to OpenCode Console

Do this whether or not you received the email. Infosecurity Magazine published a similar list from an incident-response report[2].

1. **List every key.** Write down each OpenAI, Anthropic and Google key ever saved in a Console workspace, including keys added by other admins of the workspace. Note which provider project or workspace each belongs to.
2. **Create replacements first.** Issue new keys scoped to a single project or workspace, with the least permissions the workload needs, and set a provider-side spending limit on that project or workspace. This avoids an outage when you revoke.
3. **Revoke the old keys at the provider.** Removing a key from the Console does not revoke it; only the provider can. Revoke even if usage looks clean.
4. **Deploy and confirm.** Update every system that used the old keys, then call the provider with an old key and confirm it is refused.
5. **Read usage from 16 October onward.** Look for unfamiliar models, round-the-clock usage, new regions or a jump in output tokens. [Signs your AI API key is being abused](https://infro.io/blog/signs-ai-api-key-abused) lists what to look for.
6. **Keep the evidence.** Export usage and invoices for the period. If you see charges you did not make, contact the provider's support with the key identifier and times, and keep OpenCode's email.
7. **Check your cloud projects.** If a Google Cloud project was suspended, follow the provider's appeal process; [what to do when a provider suspends your account](https://infro.io/blog/ai-provider-account-suspended-abuse) walks through it.

Provider-specific runbooks: [leaked OpenAI API key](https://infro.io/blog/leaked-openai-api-key) and [leaked Anthropic API key](https://infro.io/blog/leaked-anthropic-api-key).

> **Example: One team's rotation**
> A team had linked one OpenAI project key and one Anthropic workspace key to its Console workspace. It created a new OpenAI project `console-restricted` with a monthly budget and a key limited to model requests, and a new Anthropic workspace with a spend limit. It swapped the keys in the Console, revoked both old keys in the provider dashboards, confirmed an old key returned an authentication error, and exported usage for 16 to 21 October. Total time: under an hour.

## What this says about every tool that holds your keys

OpenCode Console did what many AI tools do, and what an AI gateway does by design: it held provider credentials so people could use models without handling the keys themselves. That pattern is useful, and it concentrates risk. A breached store of keys exposes every account behind it at once, and once a key leaves the platform, nothing the platform does can limit what is done with it.

The questions worth asking any holder of your provider keys:

| Question | Why it matters |
| --- | --- |
| How are keys encrypted at rest, and where is the encryption key kept? | A key stored next to the data it protects does not protect it. |
| Is there any read path that returns a saved key? | An API, export or support tool that can show a key can leak it. |
| What happens to keys in retired or legacy systems? | Old copies outlive the systems that were supposed to replace them. |
| How fast will you tell me, and what will you tell me? | Rotation can only start once you know. |
| Can I use a key scoped to one project with its own spend limit? | That limit is the only one that still applies after a key leaks. |

The last row is the one you control. A key with a provider-side spending limit, scoped to one project, given to one tool, turns a breach at that tool from an open-ended bill into a bounded one. [The trade you make when you give a third-party AI tool your API key](https://infro.io/blog/third-party-ai-tools-key-storage) goes further.

## How INFRO handles the keys you connect

INFRO is a holder of provider keys too: customers connect their own OpenAI, Anthropic, Google and other accounts, and INFRO uses those credentials to serve their requests. The same questions apply to us, so here are the answers.

- Each provider credential is encrypted with AES-256-GCM under a key held as a Worker secret outside the database, with the organization and connection bound in; it is never shown again after it is saved, and no endpoint, console screen or export returns it. The console shows its last four characters. See [Connect a provider](https://infro.io/docs/providers).
- Applications never hold the provider key. They use INFRO gateway keys, stored only as a digest, which belong to one environment, can be limited to chosen providers or IP ranges, and can be rotated with an overlap window or none. See [Authentication](https://infro.io/docs/authentication).
- Budgets at organization, project, member and key level refuse a request before the provider is called. See [spend controls](https://infro.io/docs/org/spend-controls).
- On the Business plan, [cost reconciliation](https://infro.io/docs/cost/reconciliation) compares what INFRO served with what OpenAI and Anthropic report, and with usage access switched on it can show traffic on a provider key that never went through INFRO.

What INFRO cannot do: if a provider key were taken from INFRO, or from anywhere else, it could be used directly against the provider, outside every INFRO budget and allowlist. That is why we recommend connecting a key scoped to a dedicated project or workspace, with a spending limit set at the provider. It is the control that holds even if we fail.

## Summary

OpenCode says a breach related to a large-scale distillation attack exposed provider keys saved by 1.4% of its Console users; the cause is unpublished and the incident is ongoing. If you linked a key, replace it with a scoped one, revoke the old one at the provider, and read your usage from 16 October onward. Then apply the same questions to every other tool holding your keys, and make sure each key it holds has a limit set at the provider.

## Questions

### What happened in the OpenCode breach?

OpenCode said it had a security breach on the night of 16 to 17 October 2026, related to a large-scale distillation attack, that affected 1.4% of OpenCode Console users: those who had external AI providers linked. Its email to those users said it found unauthorized access to a legacy system it was decommissioning and that third-party provider keys saved in a workspace may have been exposed.

### Was I affected by the OpenCode breach?

OpenCode said every affected user was emailed and that users who received no email were not impacted. If you ever saved an OpenAI, Anthropic or Google key in an OpenCode Console workspace, rotating it costs little and removes the doubt, whether or not you received the email.

### Is the OpenCode CLI affected?

An OpenCode co-founder said on X, as reported by Infosecurity Magazine, that the breach involved the OpenCode Console only, not OpenCode itself. Keys that exist only on your own machine were not part of what OpenCode described.

### What does distillation have to do with stolen API keys?

Distillation trains a model on another model's outputs. Run at scale without permission, it needs large volumes of API access, and providers and US agencies have described campaigns that used fraudulent accounts and proxy networks to get it. OpenCode called its breach related to a large-scale distillation attack but has not said how the two connect.

### Will OpenCode reimburse unauthorized charges?

BleepingComputer reported that OpenCode's message to impacted users mentioned the possibility of reimbursement. Nothing published states the terms. Keep your provider invoices and usage exports from 16 October onward.

## Sources

1. OpenCode hack exposes API keys amid AI distillation attacks — BleepingComputer. https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/ (accessed 2026-10-21)
2. OpenCode Breach Could Affect OpenAI, Anthropic and Google — Infosecurity Magazine. https://www.infosecurity-magazine.com/news/opencode-breach-openai-anthropic/ (accessed 2026-10-21)
3. Detecting and preventing distillation attacks — Anthropic. https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks (accessed 2026-10-21)
4. China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies (AA26-251A) — CISA, NSA and FBI. https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a (accessed 2026-10-21)