OpenCode Console breach exposes API keys and triggers AI charges
OpenCode says 1.4% of Console users were affected
OpenCode said attackers broke into an older system overnight and affected 1.4% of users of OpenCode Console, its online platform where some customers store API keys for AI services. The company notified affected users by email and said users who received no message were not impacted.
Developers began reporting spending alerts and unauthorised charges across Reddit and X. Some described charges in the hundreds of dollars, while a few reported totals above $1,000. OpenCode said it is processing refunds for unauthorised charges and advised affected users to revoke and replace their keys directly with each provider.
The incident was limited to Console workspaces containing stored keys. Co-founder Dax Raad said the open-source OpenCode application and its command-line tool were not affected, because keys used there do not reach the company.
Providers moved to disable exposed credentials
Anthropic and Google blocked API keys they believed had been exposed. OpenAI said it worked with OpenCode to restore access and refund API customers for credits consumed during the attack. OpenCode has not explained how attackers entered the older system, how keys were stored, or the full extent of misuse.
OpenCode described the event as related to a large-scale distillation attack, although it did not provide technical detail on how that attack occurred. The framing was challenged by some observers, who said the breach itself was established but its connection to distillation had not been demonstrated.
Safety filters complicated defensive analysis
Raad said attackers had tried to enter OpenCode systems continuously for 48 hours. The team used AI defensive agents around the clock, but models helping to analyse malicious code began refusing requests after the material triggered safety filters.
OpenCode subsequently received access to OpenAI’s Daybreak Blue program, which provides vetted users with models less likely to refuse defensive security work. Raad said that access improved the investigation. The episode echoes a July incident in which Hugging Face said commercial models blocked analysis of activity logs from an intrusion involving autonomous AI agents.
The breach occurred on the same night OpenCode made GLM-5.3-Flash free for users, while the company was still responding to the incident. For businesses using AI coding platforms, the practical priority is to avoid retaining provider keys in shared workspaces where possible, rotate any exposed credentials immediately, and treat provider spending alerts as an incident-response signal.