Quick Takeaways
- Potential key exposure: An intruder accessed a legacy OpenCode system on October 16; provider keys saved in OpenCode Console may have been exposed.
- Limited scope: OpenCode says 1.4% of Console users with linked AI providers were affected; its command-line and desktop apps were not involved.
- Act now: Affected users should revoke and replace keys with their provider, update apps and scripts, and check usage and billing from October 16 onward.
- Details remain unclear: OpenCode linked the incident to a large-scale AI distillation attack, but has not confirmed keys were copied or used—or explained how the breach happened.
OpenCode warns of possible API-key exposure
An intruder reached a legacy OpenCode system on the night of October 16. As a result, keys that some users saved in OpenCode Console may have been exposed. Those keys connect workspaces to services from OpenAI, Anthropic, and Google.
OpenCode says the affected users make up 1.4% of Console users who linked an outside provider. The company emailed them on October 17 and said others did not face the same risk. It has not confirmed that anyone copied or used a key, nor said how many users the percentage represents.
The incident affects Console, OpenCode’s optional hosted workspace service—not the company’s command-line or desktop apps, which store keys on users’ own devices. OpenCode also described the breach as related to a large-scale AI model distillation attack, but has not explained the connection. Distillation can involve gathering large numbers of model responses to train another system.
Users should replace keys and check bills
A provider key works like a password for an AI account: someone who obtains it may make requests that the account owner pays for. Deleting a key from Console does not disable it. Instead, affected users should revoke it in the provider’s own dashboard, create a replacement, and update any apps or scripts that use the old key.
They should also review provider usage and billing from at least October 16, then set spending alerts or limits. Some users have reported unexpected charges, but OpenCode has not confirmed those claims. The company says attackers continued trying to access its systems as it worked with the three providers to strengthen security.
Shared AI workspaces can make it easier for teams to use powerful tools without passing keys among colleagues. However, this incident shows why convenience must come with careful key management. As AI tools spread into everyday work, clear security steps can help people benefit from them while limiting the cost of a mistake.
Expand Your Tech Knowledge
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Stay inspired by the vast knowledge available on Wikipedia.
DataProtection-V1
