OpenCode Console Breach Hit Saved OpenAI, Anthropic and Google Keys for 1.4% of Users, and Some Developers Say Attackers Ran Up Bills Up to $3,000

OpenCode, the open source AI coding agent, says a breach exposed AI provider keys saved by 1.4% of users of its hosted OpenCode Console. Those were keys for services like OpenAI, Anthropic and Google that customers had linked so Console could route requests on their behalf.

Within hours, developers on X were posting bills they say attackers ran up on those keys, from about $700 to $3,000. Anthropic says it has revoked Claude keys it believes were affected, and a Google AI Studio staffer says exposed Gemini keys are blocked.

OpenCode calls the incident “ongoing” and has shared few details. Here is what the company and the model providers have actually said, what is still unconfirmed, and what you should do if you ever pasted a key into Console.

What OpenCode confirmed

The official OpenCode post on X went up at 11:26 PM IST on 17 October (17:56 UTC) and was edited 12 minutes later. It says: “We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users.”

The edited version adds that affected users were emailed that morning, that “if you did not get an email you were not impacted,” and that it was “a subset of users who had external providers linked.” OpenCode says it is “working with Anthropic, OpenAI, and Google to remediate.” The original version did not include the line about who was affected.

OpenCode has not said how many accounts 1.4% represents. When we checked on 18 October, the OpenCode status page listed no security incident, and the GitHub security advisories for the project showed nothing newer than 24 September.

Console is not the OpenCode app you run locally

OpenCode, the agent, runs in your terminal, IDE or desktop app. OpenCode Console is a separate hosted gateway, made by the same company, Anomaly, where you buy credits for curated models and where team owners and admins can connect their own providers.

OpenCode’s Console providers documentation spells out the design: “Console stores the credential and serves each provider through its gateway, so members use the models without ever seeing the provider key.” In other words, the keys sat on OpenCode’s servers by design.

OpenCode’s Dax Raad made the same point in a reply on X: “note this is the OpenCode Console, not OpenCode itself, those keys never come to us.” If you only set keys in the local app, OpenCode’s statements do not put them in scope.

What the model providers did

Anthropic moved first in public. Lydia Hallie, who works on Claude Code at Anthropic, wrote on X at 2:34 AM IST on 18 October: “We’ve been working with OpenCode on yesterday’s breach and have revoked Claude API keys we believe were affected.” She added that anyone who saved a key in OpenCode and wants “to be extra careful” should create a new one.

For Google, Evan Otero, a member of technical staff on Google AI Studio and the Gemini API, posted about two hours later: “We’ve blocked exposed API keys” and are “working with impacted customers and OpenCode.” His advice: create a new key in AI Studio, delete the old one, review usage, and contact Google Cloud Billing support about charges you did not make.

We could not find a public statement from OpenAI as of 8:30 PM IST on 18 October, even though OpenCode names it as a remediation partner.

Timeline in IST

The email and the bills: what is confirmed and what is not

An email that users say came from OpenCode, with the subject “Action Required: Potential provider key breach,” was shared on Reddit and reposted on X. As reported by The Latent, it says someone gained “unauthorized access to a legacy system that we were in the process of decommissioning” and that provider keys “saved in your workspace may have been exposed.” OpenCode confirms it sent emails, but has not published the text itself.

The money figures come from users, not OpenCode. Developer Tony Dinh posted “$1.7k gone” and said he was lucky he had set a limit. Notebookcheck cited Reddit users reporting about $400 on Anthropic and around €200 on Google. We have not verified any individual bill.

Why “distillation attack” is the odd part

OpenCode has not explained what a distillation attack has to do with leaked keys. Anthropic describes distillation as “training a less capable model on the outputs of a stronger one,” and in February accused three labs of running about 24,000 fraudulent accounts to pull more than 16 million exchanges from Claude.

Our reading, and it is only that: stolen keys tied to real paying accounts are a cheap way to get large volumes of frontier model output without tripping a provider’s fraud checks. That would fit both the “distillation” label and the sudden spending. OpenCode has not confirmed this, and several replies under its post asked the same question.

What to do right now

If you ever saved a provider key in an OpenCode Console workspace, rotate it at the provider, even if you did not get an email. It costs nothing. Do it from the provider’s own dashboard, not from a link in an email, since breach notices are common phishing bait.

• Create a new key, update every app that used the old one, then delete the old key.
• Check usage and billing on each provider for spikes since 16 October.
• Turn off auto top-up on prepaid accounts until you have checked, so a reload does not fund someone else’s usage.
• Set a spend limit or alert wherever the provider offers one. Dinh says a limit he had set capped his loss.
• Give each tool its own key, so one breach means revoking one key, not all of them.

Any hosted gateway that holds your raw provider keys becomes a single point of failure for all of them. We saw a related pattern in OpenAI’s own disclosure about a model that spent a stranger’s test ETH found in public data, and in research showing 9 of 10 coding agent setups erased their own logs when asked.

What it means for Indian developers

Most Indian developers pay these providers in US dollars on international cards, so an unnoticed key leak hits hard. At 95.08 rupees to the dollar (open.er-api.com, 18 October 2026), a $1,700 bill is about ₹1.62 lakh and $3,000 is about ₹2.85 lakh, before any bank forex markup.

Small Indian teams often share one Console workspace with a single provider key that only the owner can see. That makes the owner or admin the only person who can rotate it, so check who that is today.

If you run a company in India and an attacker used your credentials, ask your security lead whether CERT-In’s April 2022 directions apply. They require listed incidents, including “unauthorised access of IT systems/data,” to be reported within 6 hours of noticing them. If you are choosing tools, our guide to AI IDEs for Indian developers compares options with rupee prices.

FAQ

Was the OpenCode app itself hacked?

OpenCode says the breach hit OpenCode Console, its hosted gateway. Dax Raad says keys used in the regular OpenCode app “never come to us.” No new security advisory has been published for the open source project.

How do I know if I was affected?

OpenCode says it emailed every affected user on 17 October and that anyone without an email was not impacted. Check spam folders. Rotating any key you saved in Console is still the safe move.

Will OpenCode refund unauthorized charges?

Dax Raad says refunds are “already underway” and has asked affected users to email him with details. OpenCode has not published a formal refund policy, so keep screenshots of your provider bills.

Which providers have acted?

Anthropic says it revoked Claude keys it believes were affected, and Google says exposed Gemini keys are blocked. OpenCode names OpenAI as a partner, but we found no public OpenAI statement as of 18 October.

What is a distillation attack?

It means harvesting a strong model’s outputs at scale to train another model. OpenCode used the term but has not explained how it connects to the leaked keys.