OpenCode Console breach: what happened and what to do

On October 17, OpenCode said someone broke into its hosted Console product and got at API keys that about 1.4% of Console users had saved there for OpenAI, Anthropic and Google. If you stored a provider key in OpenCode Console, revoke it on that provider's own dashboard, make a new one, and check your usage and billing for anything you don't recognize.

The open-source OpenCode agent that runs in your terminal is a separate product, and it was not what got hit.

What OpenCode posted

OpenCode disclosed the breach in a post from @opencode on Saturday, blaming "a large scale distillation attack" that hit 1.4% of Console users. It emailed affected users that morning and said anyone who didn't get an email was not affected. Only users who had linked external providers were in the affected group. The company called the incident ongoing and said it was working with Anthropic, OpenAI and Google on the cleanup.

Security outlets that saw the notice emails report that the entry point was a legacy Console system OpenCode was already shutting down. OpenCode hasn't said how the attacker got in, how the keys were stored, or whether any of them were used. Some users say they've seen surprise charges on their provider accounts, but nobody has matched those reports against OpenCode's own numbers yet.

A word on the jargon. "Distillation" usually means training a cheaper model on a stronger model's outputs, and stolen API keys let someone do that at scale on another person's bill. That fits OpenCode's wording. It's my reading, though, not something the company has explained.

Anthropic revoked affected Claude keys

The same afternoon, Lydia Hallie from Anthropic's Claude Code team posted that Anthropic had been working with OpenCode and had "revoked Claude API keys we believe were affected." She added that anyone who saved a key in OpenCode and wants to be extra careful should create a new one.

So Anthropic shut off some Claude keys on its own. That only covers the keys Anthropic identified, though. If you had a key in Console and it still works, don't take that as a sign it's clean.

Console versus OpenCode itself

OpenCode's dax (@thdxr) replied to Hallie to separate two things people kept mixing up: "this is the OpenCode Console, not OpenCode itself, those keys never come to us." The local agent sends your key straight from your machine to the model provider. Console is the hosted web product where people could save provider keys in a workspace, and those saved keys are what leaked.

He's right, and it's good news for the large majority of Console users who weren't emailed and for everyone who only runs the local tool. The broader point holds anyway: when you paste a key into a hosted service, that service's security becomes yours.

What to do if you used OpenCode Console

• Revoke the key in each provider's own console (OpenAI, Anthropic, Google, OpenRouter or whatever else you linked). Changing the key inside OpenCode leaves the old one working.
• Create a new key, update every app or script that used the old one, then confirm the old key is actually dead.
• Look at provider usage and billing since mid-October for spikes, models you don't use, or activity at odd hours.
• Put hard spend limits and usage alerts on every provider account, so the next leaked key has a ceiling.
• Remove any provider links from Console you no longer need.

Why AI keys are worth stealing

Third-party tools get breached all the time. What stands out here is what was taken. A leaked AI key can be turned into spending within minutes, and the bill lands on whoever owns the account. For a lot of small companies these keys are among their most valuable credentials and also the least watched. A developer creates one, pastes it into three tools, and nobody writes down where it went.

If your team uses AI coding tools, chat apps or automations, you probably have keys sitting in services nobody keeps a list of. Fixing that is mostly bookkeeping. Give each tool its own key with a spend cap, send the alerts to someone who reads them, and keep a short list of where every key lives. Then when a vendor sends an email like OpenCode's, rotating takes ten minutes instead of an afternoon of digging.

New Face Design's free process audit looks at this while mapping your automations, including which tools hold your credentials and who would notice if one of them started spending.