OpenCode Leak: $1,700 Billed Overnight on 3 AI Keys [2026]

OpenCode has confirmed a security breach that may have exposed OpenAI, Anthropic, and Google API keys belonging to users of its cloud management service, OpenCode Console. The company said an intruder reached a legacy system on the night of October 16, 2026, and that the earliest possible exposure window for affected keys began at 00:30 UTC on October 17, 2026. OpenCode is calling the incident a large scale distillation attack and says it is working with all three AI providers to investigate.

The breach is narrower than the OpenCode name suggests. It did not touch the open source OpenCode coding agent that developers run locally. It hit OpenCode Console, the hosted service that stores workspace credentials and uses them to call out to external AI providers on a team’s behalf. According to OpenCode, 1.4% of Console users who had linked an external provider were caught in the affected group, and the company emailed every one of them on October 17, 2026, with the subject line “Action Required: Potential provider key breach,” as reported by ibtimes.sg.

Google · Preferred Sources

Don't miss new tech stories on Google

Add TrendinTech once in the Google app and our stories appear in your news suggestions.

Add Now

What happened in the OpenCode Console breach

OpenCode’s account of events is specific about timing but deliberately vague about mechanism. The company says an intruder accessed a legacy system overnight on October 16, 2026, and that this access created a window during which third party provider keys saved inside OpenCode Console workspaces could have been read. OpenCode has not published a root cause analysis, and it has not said how the intruder got into the legacy system in the first place.

What makes this incident notable is the target. OpenCode Console is not a consumer product. It is infrastructure that development teams use to centralize credentials for the AI coding agent, then let the Console make calls to OpenAI, Anthropic, and Google on a workspace’s behalf rather than scattering raw API keys across local machines, CI pipelines, and config files. That design is meant to reduce key sprawl. When the credential store itself is compromised, the same centralization becomes a single point of failure that can expose many providers’ keys through one entry point.

Bleeping Computer was among the first outlets to report that multiple users had already reported unauthorized AI usage charges tied to the incident before OpenCode’s notification emails went out widely, which suggests some exposed keys were put to use quickly after the breach window opened.

Who is affected: 1.4% of Console users, three AI providers

OpenCode has been precise about the scope it is willing to confirm. The company says 1.4% of OpenCode Console users are potentially affected, specifically those who had linked at least one external AI provider to their workspace. Users who never connected a provider key to Console, OpenCode says, were not exposed by this incident.

The three providers named in OpenCode’s own notification are OpenAI, Anthropic, and Google. OpenCode’s email to affected users stated plainly that “third party provider keys (e.g. OpenAI, Anthropic) saved in your workspace may have been exposed.” That phrasing matters because it frames the exposure as credential-level, not account-level: the risk is that someone outside the workspace could use the linked provider accounts’ billing and inference capacity, not that OpenCode’s own product accounts were compromised.

OpenCode says it is coordinating with Google, OpenAI, and Anthropic directly on the response, which typically means helping providers flag abnormal usage patterns on the affected accounts and supporting any key revocation the providers choose to carry out on their end.

OpenCode Console versus the OpenCode coding agent

The distinction between OpenCode the product and OpenCode Console the hosted service became a flashpoint almost immediately, because the two get conflated in casual references to “the OpenCode breach.” Dax Raad, a contributor to OpenCode and co-founder of Anomaly, moved to correct the record, saying the breach involved “the OpenCode Console, not OpenCode itself.”

That clarification is more than semantics for developers deciding how worried to be. OpenCode the coding agent runs locally or in a self-managed environment and does not, by itself, require a developer to upload provider credentials to a third party server. OpenCode Console is the layer that does exactly that: it exists so teams can manage shared credentials and usage centrally rather than letting every engineer hold raw OpenAI or Anthropic keys on their own laptop. Readers who have followed the rollout of OpenCode 2.0’s expanded API access to more than 75 AI models will recognize Console as the piece of the stack built to make that broad provider access manageable at the team level. It is also the piece now at the center of this breach.

What is a distillation attack, and why OpenCode used that label

OpenCode has described the incident internally and publicly as a large scale distillation attack. In AI security terms, a distillation attack typically refers to an attempt to extract a model’s learned behavior, outputs, or underlying weights by systematically querying it, often at volume, using someone else’s paid access to the model. Framing the OpenCode Console breach this way implies the intruder’s goal was not simply to resell or hoard stolen API keys, but to route large volumes of inference traffic through compromised provider accounts to harvest model outputs at someone else’s expense.

That theory lines up with the complaints about unexpected billing. If the objective were quiet, long-term access, an attacker would have an incentive to stay under the radar. Heavy, sudden usage spikes are the opposite of stealthy, but they are exactly what a distillation run looks like: thousands of rapid calls to extract model behavior before the window closes. This is not the first time Anthropic specifically has dealt with this attack pattern. The company said earlier in 2026 that it had cut a related class of distillation attacks by 99% through detection and mitigation work, highlighting that extraction attempts against frontier model providers were already an active concern before this particular breach.

Unauthorized charges: what users are reporting

Beyond OpenCode’s own disclosure, the clearest signal that keys were actively misused, rather than just exposed in theory, comes from affected users describing real bills. At least one report cited by Bleeping Computer described unauthorized usage charges exceeding $1,700 in a single overnight period on an account linked through OpenCode Console. OpenCode has not confirmed a total dollar figure for unauthorized charges across all affected accounts, and no outlet has published a verified aggregate number as of this writing.

That gap between one confirmed data point and an unknown total is typical of the early days of a credential breach. Provider-side billing systems take time to flag anomalous usage, affected users take time to notice and report charges, and companies are generally cautious about publishing financial exposure estimates before they have reconciled the numbers internally. Until OpenCode or one of the three AI providers publishes a consolidated figure, any total beyond the $1,700 overnight example should be treated as unconfirmed.

How OpenAI, Anthropic, and Google are responding

OpenCode has stated it is working with Google, OpenAI, and Anthropic on the incident, but the public detail on what each provider has actually done is thin and uneven. The one specific, named action on record comes from Anthropic’s side: a report attributes suspected key revocation activity to Anthropic’s Lydia Hallie. No equivalent named confirmation exists yet for OpenAI or Google revoking affected keys, which does not mean those providers have done nothing, only that no source has publicly attributed a specific revocation action to either company at this point.

This is a familiar pattern in multi-vendor credential breaches: the platform that got breached (OpenCode) controls the narrative and timeline of its own disclosure, while the downstream providers whose keys were exposed (OpenAI, Anthropic, Google) typically respond through quieter account-level security operations rather than public statements, unless a provider decides the incident is significant enough to warrant its own advisory. Readers tracking Anthropic’s broader security posture may recall the company’s warnings from one of its executives earlier this year about elevated risk in open source AI tooling, a theme that resurfaces whenever an open source project’s infrastructure, rather than a closed commercial platform, turns out to be the point of compromise.

Timeline of the OpenCode Console breach

Date and time	Event
Night of October 16, 2026	Intruder accesses a legacy OpenCode system, per OpenCode’s own account
October 17, 2026, 00:30 UTC	Earliest possible exposure window for affected provider keys begins
October 17, 2026, 18:08 UTC	OpenCode confirms the breach publicly on X, describing it as a large scale distillation attack
October 17, 2026	OpenCode emails affected users with subject line “Action Required: Potential provider key breach”
October 17 to 18, 2026	Users begin reporting unauthorized AI usage charges, including one case exceeding $1,700 overnight
October 18 to 19, 2026	Security outlets including Bleeping Computer, The Hacker News, and Infosecurity Magazine publish breach coverage; OpenCode says it is coordinating with OpenAI, Anthropic, and Google

How this breach compares with other 2026 data exposure incidents

The OpenCode Console breach is smaller in raw headcount than several other disclosures that have run on this site through 2026, but it belongs to a distinct category: it exposes credentials that grant ongoing access to paid AI inference, not static personal records. A stolen record from a DMV or a retailer is a fixed liability. A stolen API key is a live one, capable of generating new charges and new model outputs for as long as it stays valid. The table below places this incident alongside other notable breaches from the same year for scale, while flagging that the underlying risk profiles are not interchangeable.

Incident	Entity affected	Scale disclosed	What was exposed
OpenCode Console breach	OpenCode Console users with linked providers	1.4% of Console users	OpenAI, Anthropic, and Google API keys
Oracle Health breach	Oracle Health patients, per the Texas Attorney General	19.9 million records	Patient health data
AI agent hacker campaign	More than 100 firms	100+ companies	Corporate systems breached via automated AI agent, reportedly at roughly $50 per breach
Florida DMV breach	Florida DMV records tied to a Plant City Police login	Hackers claimed 200,000 records	Driver and vehicle records

The market impact for AI coding platforms

OpenCode operates in a crowded field of AI coding tools competing on how much model access they can offer and how easy that access is to manage across a team. The breach lands at an awkward moment for that pitch. Centralized credential management, the exact feature Console sells, is also the exact feature that turned a single legacy-system intrusion into a multi-provider incident touching OpenAI, Anthropic, and Google customers at once. Competing platforms that have pushed deeper into multi-model orchestration, including the expanding roster of tools covered in coverage of the AI coding tool race between Claude Code, Cursor, and others, face the same structural tradeoff: the more providers a platform lets a team wire together in one place, the more valuable that one place becomes to an attacker.

For OpenCode specifically, the reputational cost compounds an existing challenge. Open source infrastructure projects generally earn trust by being auditable, but Console is the hosted, closed-loop piece of the stack, and this breach is a reminder that “open source agent, hosted credential broker” is a hybrid trust model that has to be evaluated on both halves independently. A team that fully trusts the open source agent code is still taking on a separate, less visible trust dependency the moment it links provider keys into the hosted Console.

Historical context: why centralized key stores keep getting hit

This is not the first time a developer tool built to simplify credential management has become the mechanism for a mass credential exposure. The pattern recurs because the economics of the problem never change: storing a secret in exactly one place reduces operational complexity and also concentrates risk in that one place. Password managers, CI secret stores, and now AI provider key brokers like OpenCode Console all occupy the same tradeoff space. Teams that have set up their own credential hygiene around direct provider API key setup rather than routing keys through a third party broker avoid this specific failure mode, at the cost of losing the centralized usage visibility that tools like Console are built to provide.

The broader AI cyberattack picture has been getting more attention from policy circles too. Earlier in 2026, international monitors flagged rising concern about AI-enabled attacks more generally, a theme that showed up in warnings about AI-driven cyberattack risk discussed in coverage of the IMF’s warning on AI cyberattacks. The OpenCode Console incident fits that trend line less as an AI model doing the attacking and more as AI infrastructure, the credentials and billing relationships that make AI tools work, becoming the target itself.

What affected users should do right now

Revoke and regenerate any OpenAI, Anthropic, or Google API key that was ever linked to an OpenCode Console workspace, even if you have not received a notification email yet.
Check your inbox for an email from OpenCode with the subject “Action Required: Potential provider key breach” and treat it as authoritative confirmation if it arrives.
Review provider-side billing and usage dashboards for OpenAI, Anthropic, and Google for unexpected spikes dating back to October 17, 2026, 00:30 UTC.
Update any application, script, or CI pipeline that referenced the old key once a replacement key is issued.
Treat OpenCode Console credentials going forward with the same rotation discipline applied to any other third party secret broker.

OpenCode’s own guidance to affected users lines up with standard incident response practice: revoke, replace, review usage, and update dependent applications. The company has not said whether it is offering reimbursement for unauthorized charges incurred before users could rotate their keys, and no provider has published a reimbursement policy specific to this incident as of October 19, 2026.

Why the 1.4% figure understates the exposure for some teams

A 1.4% headline figure sounds small until it is translated into actual usage patterns. OpenCode Console is a team product, which means each affected account is not necessarily one individual developer. A single compromised workspace can represent an entire engineering team’s shared OpenAI, Anthropic, or Google access, with usage limits and billing tied to the organization rather than a person. That means the real-world blast radius, measured in dollars at risk or in the number of engineers whose work is disrupted while keys rotate, can be considerably larger than the percentage of accounts suggests.

It is also worth being precise about what remains unverified. OpenCode has not confirmed that every potentially affected key was actually accessed, copied, or misused, only that exposure was possible for accounts in the affected group. The distinction between “potentially exposed” and “confirmed compromised” matters for how urgently any individual team should treat its own rotation, but given the reports of real unauthorized charges, the safer assumption for any affected user is to treat potential exposure as actual exposure until proven otherwise.

Predictions: what happens next

OpenCode will likely publish a more detailed post-incident report once its internal investigation and the three providers’ usage reviews conclude, following the pattern of other developer-tool breaches that start with a short disclosure and expand later.
Expect at least one of OpenAI, Anthropic, or Google to confirm specific remediation steps, such as mass key revocation for the affected cohort, once internal verification is complete.
Competing AI coding platforms that offer centralized multi-provider credential management will face renewed scrutiny over how they store and isolate customer keys, likely prompting some to publish their own security architecture explanations proactively.
A consolidated figure for total unauthorized charges across all affected users is likely to surface in follow-up reporting within weeks, given that at least one $1,700 overnight case is already public.
This incident will likely be cited in future discussions of AI infrastructure security as a reference case for why centralizing provider credentials, even for legitimate usability reasons, creates a single point of failure across multiple AI vendors simultaneously.

The bigger picture for AI developer tool security

The OpenCode Console breach arrives as AI coding agents have become normal infrastructure rather than novelty tools, which raises the stakes for any single point of failure in that stack. A credential broker that connects to OpenAI, Anthropic, and Google at once is attractive precisely because it saves teams from juggling separate keys and separate billing relationships. That same convenience is what let one legacy-system intrusion cascade into exposure across three of the industry’s largest AI providers simultaneously, rather than remaining contained to a single vendor relationship.

Security researchers and developer tool vendors have warned for years that secret sprawl, meaning API keys and credentials scattered across code, configs, and third party services, is one of the most persistent risks in modern software supply chains. The irony of the OpenCode Console breach is that it happened to the kind of product built specifically to solve secret sprawl. Centralizing credentials reduces the number of places a key can leak from accidentally, but it also means a single successful intrusion can now touch every provider a workspace ever connected, which is exactly what appears to have happened here.

Frequently asked questions

What exactly was breached, OpenCode or OpenCode Console?
OpenCode Console, the hosted service that stores and manages third party provider credentials, was breached. The OpenCode coding agent itself was not affected, according to OpenCode contributor Dax Raad.

How many users are affected by the OpenCode Console breach?
OpenCode says 1.4% of Console users who had linked an external AI provider are potentially affected. Users who never connected a provider key to Console were not exposed by this incident.

Which AI providers’ API keys were potentially exposed?
OpenAI, Anthropic, and Google. OpenCode named all three in its notification to affected users.

What should I do if I had an OpenAI, Anthropic, or Google key linked to OpenCode Console?
Revoke and replace the key immediately, review your provider billing dashboards for unexpected charges since October 17, 2026, 00:30 UTC, and update any application or pipeline that used the old key.

What is a distillation attack, and why did OpenCode use that term?
A distillation attack generally refers to extracting a model’s behavior or outputs through high-volume querying, often using someone else’s paid access. OpenCode described this incident as a large scale distillation attack, suggesting the intruder aimed to harvest AI model outputs through compromised provider accounts.

Have unauthorized charges actually been confirmed?
Yes, at least one user reported unauthorized AI usage charges exceeding $1,700 in a single overnight period. OpenCode has not confirmed a total figure across all affected accounts.

Have OpenAI, Anthropic, or Google confirmed revoking exposed keys?
A report has attributed suspected key revocation activity to Anthropic’s Lydia Hallie. No equivalent public confirmation exists yet for OpenAI or Google revoking affected keys specifically.

When did the breach happen and when was it disclosed?
OpenCode says an intruder accessed a legacy system on the night of October 16, 2026, with the earliest possible exposure beginning October 17, 2026, at 00:30 UTC. OpenCode confirmed the breach publicly and emailed affected users on October 17, 2026.

OpenCode Console Breach Exposes OpenAI, Anthropic Keys [2026]