OpenCode Console incident puts saved AI provider keys at risk
OpenCode says an intruder accessed a legacy system on the night of October 16, potentially exposing third-party AI provider keys stored in its optional hosted Console service. The company said 1.4% of Console users were affected, all with an external provider linked to a workspace.
OpenCode emailed affected customers on the morning of October 17 under the subject line “Action Required: Potential provider key breach.” It said users who did not receive that message were not affected. The company has described the incident as involving OpenCode Console rather than its command-line and desktop applications.
Saved credentials require provider-side revocation
Console lets a workspace save its own OpenAI, Anthropic or Google key, then uses that credential to call the provider while allowing team members to use models without viewing the key. By contrast, provider keys added to OpenCode’s command-line and desktop apps are kept locally in a SQLite database on the user’s machine.
A provider key functions as a bearer credential: anyone holding it can submit billable requests to the owner’s account until the provider revokes it. OpenCode told affected users to revoke the old key in the relevant provider dashboard, create a replacement, and update every application and script using the previous credential.
Removing a key from Console is not equivalent to revocation. Nor can a Console budget contain misuse outside its gateway, because it sees only requests routed through that service. Teams should review provider usage and billing for unfamiliar activity from at least October 16, then configure provider-side spending limits or alerts.
Investigation remains incomplete
OpenCode said the breach was related to a “large-scale distillation attack” and that it was working with Anthropic, OpenAI and Google. It has not identified the actor, explained how the legacy system was accessed, stated when unauthorized access began, or disclosed how many keys were stored there.
Distillation campaigns seek model outputs at scale to train a competing system. Anthropic said in September that operators behind such campaigns have reached models through fake-account networks using stolen payment cards, login credentials and harvested API keys. The risk posed by exposed credentials is also illustrated by AI systems and exposed credentials in attacks through its account of AI systems and exposed credentials in an attack scenario.
OpenCode has said keys may have been exposed, not that they were copied or used. Still, some users reported charges they say they did not incur, including claims involving OpenAI, Anthropic and Google accounts. On October 18, co-founder Dax Raad said attackers had continued trying to access OpenCode’s systems for 48 hours and that the company was hardening its environment.
Credential inventory is the immediate business task
For organisations using Console, the practical priority is to identify every workspace-saved provider key, rotate any credential flagged by OpenCode, trace each old key across integrations, and examine provider billing. Issuing distinct keys per tool, with provider-level alerts and limits, reduces the scope of a copied credential and makes suspicious usage easier to attribute.