OpenCode says an intruder accessed a legacy system on Oct. 16 and may have exposed third-party API keys stored in its hosted Console service, putting some OpenAI, Anthropic and Google users at risk. The company said the incident affected 1.4% of Console users with external providers linked and described it as related to a “large-scale distillation attack.” [2]
Console lets teams save their own provider credentials in a workspace so members can use AI models without seeing the underlying keys. The incident concerns keys pasted into Console, not credentials stored locally by OpenCode’s command-line or desktop applications, according to OpenCode co-founder Dax Raad. Users who received an email titled “Action Required: Potential provider key breach” were told to revoke and replace the affected credentials.
The exposure is potentially serious because provider API keys are bearer credentials: anyone who obtains one may be able to submit billable requests until the provider invalidates it. Removing a key from Console does not revoke it at the provider, and OpenCode said it had not determined whether the keys were copied or used. Some users have publicly reported unexpected charges, but those reports have not been independently confirmed as consequences of the breach.
OpenCode has not disclosed the legacy system’s identity, the initial access method, the number of keys involved or the number of affected accounts represented by 1.4%. It also has not named a threat actor. The company’s reference to model distillation provides context, but does not establish attribution: distillation campaigns typically collect large volumes of model output to train or improve another system. No CVE, public proof of concept or exploitation-in-the-wild report has been identified for this incident.
OpenCode’s guidance is to revoke the potentially exposed key in the relevant OpenAI dashboard, Anthropic Console or Google AI Studio, create a replacement and update every application or script that used the old credential. Organizations should also review provider usage and billing for unexpected activity dating back to Oct. 16, then configure spend limits or alerts and use separate keys for separate applications.
The disclosure illustrates the risk of centralizing high-value AI credentials in an intermediary service. Until OpenCode publishes a fuller incident report, defenders should treat any provider key saved in an affected Console workspace as compromised, preserve billing and access logs for investigation, and avoid relying on deletion from Console as evidence that the credential has been neutralized.
