The OpenCode breach is a fresh warning for anyone who stores AI API keys in a third-party tool. OpenCode, a popular open-source AI coding agent, says an attacker reached an older system on the night of October 16 and may have exposed the OpenAI, Anthropic and Google keys that some users saved in its hosted OpenCode Console. Within hours, developers started reporting spending alerts and charges they never made.
What Happened in the OpenCode Breach
OpenCode has been gaining fans as a free alternative to paid coding agents. Most people run it on their own computer, but the company also offers Console, an optional hosted workspace where teams can save their own provider keys so members can use AI models without seeing the keys.
That hosted service is where the trouble started. OpenCode says 1.4% of Console users were affected, all of whom had linked an outside AI provider. The company emailed those users on the morning of October 17 and told them to revoke and replace their keys with each provider.
The company described the incident as “related to a large-scale distillation attack.” Distillation means pulling huge numbers of answers from a strong AI model to train a rival one, and stolen keys are one way to pay for that. Some critics said the label was a stretch, since OpenCode has not shown how the breach and any distillation are linked.
Who Was Not Affected
The open-source command-line tool and desktop app were not part of the breach. Those apps keep keys in a local database on your own machine, so they never reach OpenCode’s servers.
Co-founder Dax Raad stressed this point publicly, saying the problem was limited to Console. If you never got the warning email, OpenCode says you were not affected.
OpenCode Breach Charges and Refunds
Developers quickly posted screenshots of spending alerts from multiple AI providers firing overnight. Many described charges in the hundreds of dollars, and a few said their totals topped $1,000.
The big AI companies moved fast. Anthropic and Google blocked keys they believed were exposed, while OpenAI said it worked with OpenCode to restore access and refund credits used in the attack. OpenCode says refunds for unauthorized charges are underway.
| Detail | What We Know |
|---|---|
| When it started | Night of October 16, 2026 |
| System hit | An older system behind OpenCode Console |
| Users affected | 1.4% of Console users |
| Keys at risk | OpenAI, Anthropic and Google keys saved in Console |
| Not affected | Open-source CLI and desktop app |
| Status | Company called the incident ongoing |
When AI Safety Filters Got in the Way
The response also exposed an awkward problem for defenders. Raad said attackers kept hammering OpenCode’s systems nonstop for about 48 hours, so the team kept AI defensive agents running around the clock.
The AI models the team used for analysis helped at first, then began refusing to work once the malicious code they were studying tripped safety filters. OpenCode later got access to OpenAI’s Daybreak Blue program, which gives vetted security teams models that are less likely to refuse defensive work, and Raad said that improved the investigation.
This is not the first time it has happened. Hugging Face hit the same wall in July while analyzing an intrusion, and David Sacks, co-chair of the President’s Council of Advisors on Science and Technology, said the guardrails “backfired” in both cases. It adds to a busy month of AI-powered attacks, including the AI hacking campaign that hit more than 100 company websites.
What This Means for You
An AI API key works like cash. Anyone who copies it can run up bills on your account until the provider shuts it off, and deleting the key from a third-party app does not cancel it. If you build with tools like Claude or other model APIs, here is what to do:
- Revoke any key you saved in OpenCode Console and create a new one in the provider’s own dashboard.
- Update every app and script that used the old key.
- Check your usage and billing for requests you did not make, going back to at least October 16.
- Set spending limits or alerts with each provider so a stolen key does less damage.
- Give each tool its own key, which makes misuse easier to spot and cut off.
If you are weighing AI tools for security work, our guide on AI threat detection covers the basics. You can also read how AI labs are fighting back in our piece on distillation defenses.
Questions Still Open
OpenCode has not said how attackers got in, how keys were stored, or how many people 1.4% represents. It also has not confirmed that any specific key was copied or used. Keep an eye on our AI news feed for updates as the company shares more.
Sources
This article is based on reporting from TechCrunch and The Hacker News, which cite OpenCode’s posts and emails to affected users.
Conclusion
The OpenCode breach was limited to a small slice of Console users, but the surprise bills show how much damage one leaked API key can do. Providers moved quickly to block keys and issue refunds, and OpenCode says it is hardening its systems. The bigger lesson is about guardrails: the same safety filters that stop attackers can also slow down the people trying to stop them. If you saved keys in any hosted AI tool, now is a good time to rotate them and set spending caps.
