Stolen Keys, Someone Else’s Bill: The OpenCode Console Breach and the Distillation Economy Behind It (AI Trends, 19 October 2026)

What’s trending in AI on 19 October 2026: OpenCode, the open-source AI coding agent used by developers in the terminal, the desktop and their editors, has told a slice of its hosted Console customers to revoke every AI provider key they saved there. The company says an intruder reached a legacy system it was in the process of shutting down, that OpenAI, Anthropic and Google keys stored in Console workspaces may have been exposed, and that the incident is tied to what it calls a large-scale distillation attack. About 1.4% of Console users were affected. Several of them say the first sign was a bill: hundreds of dollars, in one case around $1,700, of model usage they never ran. Below: what OpenCode has and has not said, why stolen AI keys have become the raw material for model distillation, where your own keys are most at risk, and a first-hour-to-first-quarter runbook for any team that hands provider keys to a third-party tool.

Key takeaways

Hosted keys only. The exposure covers provider keys pasted into OpenCode Console workspaces. Keys added through the OpenCode CLI or desktop app are stored locally, and OpenCode says they were not part of this incident.
The loot was compute, not passwords. A stolen provider key lets someone else run frontier models on your account. Reports so far point to bills, not leaked personal data.
Deleting a key in Console does not kill it. Only revoking it in the OpenAI, Anthropic or Google dashboard stops a copy that has already been taken.
Distillation needs other people’s keys. Anthropic said in September that distillation campaigns run on fake accounts built partly from harvested API keys. Aggregators that store many customers’ keys are an obvious target.
Many questions are still open. OpenCode has not explained how the attacker got in, how many keys were held, when access began or who was behind it.

The asset taken in the OpenCode breach was not a password list but the ability to run frontier models on someone else’s bill.

1. What happened at OpenCode

OpenCode is an open-source coding agent that works with many model providers. Most developers run it locally and plug in their own keys. Teams can also use OpenCode Console, a hosted layer where a workspace shares models, sets budgets and links the members’ own accounts at OpenAI, Anthropic, Google and other providers. That last feature is what failed.

According to The Hacker News, an intruder reached a legacy OpenCode system on the night of 16 October. On 17 October, affected users received an email flagged as requiring action, warning that third-party provider keys saved in a Console workspace may have been exposed and asking them to revoke and replace those keys and review recent usage. Security researcher Matt Johansen posted a screenshot of the email that afternoon, and OpenCode confirmed the breach publicly on X a few hours later. The company said the affected group was about 1.4% of Console users, all of whom had linked an outside provider, and that anyone who did not get the email was not affected. It said it was working with Anthropic, OpenAI and Google on the response and described the incident as ongoing.

Co-founder Dax Raad drew a firm line around the scope. The breach involves the OpenCode Console, he said, not OpenCode itself: keys added through the CLI or desktop apps sit in a local database on the user’s machine and “never come to us”. That evening he posted that his own personal accounts were under attack too. By the morning of 18 October, according to OfficeChai, he wrote that attackers had been trying to break into OpenCode’s systems non-stop for 48 hours and that the team was hardening its defences.

The breach landed weeks after Anthropic warned that distillation campaigns run on harvested accounts and keys.

2. What we still don’t know

Be careful with the early coverage, because much of it fills gaps with guesses. As of Monday morning, OpenCode has not published a technical post-mortem. It has not named the legacy system or said how the intruder reached it. It has not said how many keys it held, how they were stored, whether every exposed key was actually copied, or when unauthorised access started. It has not named a perpetrator, and it has not explained exactly how the distillation attack it mentions relates to the breach.

What exists instead are user reports. The Hacker News, citing Dealroom and Notebookcheck, collected several: one developer described about $281 of OpenAI usage and $168 of Anthropic usage he did not run, another reported losses of around $1,700, a Reddit user described roughly $400 on an Anthropic account, and another said about €200 of Google usage appeared before the project was suspended. Crypto Briefing reported that some affected users watched their balances drain quickly. OpenCode has not confirmed that any of these charges came from keys taken in its breach, and it has not said how surprise bills will be handled.

So far the visible damage is on provider bills, which is exactly what a key-harvesting distillation operation would produce.

3. Why a “distillation attack” wants your API key

Distillation is a normal machine-learning technique: you train a smaller or cheaper model on the outputs of a stronger one. It becomes an attack when someone does it at scale against a commercial model, in breach of its terms, to copy capabilities they did not pay to build. The frontier labs have been fighting this all year. Anthropic first raised the issue publicly in February. In its September threat report, covered by TechCrunch on 10 September, it described nearly 200 million exchanges linked to distillation across five campaigns, including one it attributed to Alibaba that ran to 151 million exchanges over 3,500 accounts and peaked at almost 3 million exchanges a day.

Running that many queries is expensive and easy to spot on accounts you own. That is why, as The Hacker News notes from Anthropic’s report, distillation operations build their account networks from fake identities, stolen credit cards, stolen logins and harvested API keys, and why criminal markets resell keys and tokens. A stolen key is free, it carries someone else’s reputation and spending history, and when it is shut off the operator simply moves to the next one.

Put that next to a hosted service that stores many customers’ keys for several providers in one place, and the attraction is obvious. Crypto Briefing described the stolen asset as the ability to make large volumes of queries on someone else’s account, which concentrates risk in aggregators. We should be clear that OpenCode has not explained the link, and the idea that its stolen keys fed a distillation pipeline is a reasonable reading of its own label and the reported bills, not a confirmed finding. We explored the geopolitical side of model copying in our piece on AI know-how becoming a spy target, and the open-weight race that makes distilled capability valuable in open-weight models trailing the frontier by months.

For a distiller, a stolen key is free compute with someone else’s name on it.

4. Where your keys live decides your exposure

The most practical lesson from this incident is that “we use OpenCode” is not one risk but several, depending on where each key sits. Two details matter more than the rest. First, deleting a key from a Console workspace does not revoke it at the provider, so anyone who already copied it can keep using it. Second, Console budgets only cap spend routed through OpenCode’s own gateway; a stolen key used directly against OpenAI or Anthropic bypasses them entirely, as both Cyera and The Hacker News point out.

Where the key is stored	Status in this incident	What to do
Saved in an OpenCode Console workspace	May have been exposed (about 1.4% of Console users emailed)	Revoke at the provider now, reissue, check usage from 16 October
Added via OpenCode CLI or desktop app (stored locally)	OpenCode says these keys never reach its servers	Rotation is cheap insurance while the investigation is open
OpenCode Console’s own API keys and account password	Not specifically named, but part of the same platform	Reset the password and regenerate Console keys
The same provider key reused in CI jobs, apps or other agents	Exposed wherever the Console copy was exposed	Map every consumer before revoking so you can update them fast
Keys in other hosted gateways, routers or agent platforms	Not involved, but carry the same concentration risk	Inventory them and apply the same spend caps and scoping

Sources: The Hacker News; Cyera; DEV Community. Based on OpenCode’s statements as of 19 October 2026.

That last row is the one most companies will skip. AI tools that hold your provider keys are multiplying: coding agents, model routers, evaluation platforms, chat front ends, workflow builders. We saw the same pattern three days ago in Fireworks AI’s secrets breach and Meta’s GitHub leak, and earlier in attacks on AI infrastructure such as LiteLLM gateways. Yesterday’s CERT-In alert on leaked keys made the same point from another direction: wherever a key is left, someone or something will eventually find it.

The same coding agent can carry very different risk depending on whether its keys sit locally or in a hosted workspace.

5. Defenders hit the guardrails too

One small detail from the weekend deserves attention. Raad wrote that defenders need AI agents running around the clock because attackers already run them that way. Asked whether frontier models’ cyber safeguards were getting in the way, he said the models “did quite a bit and then started refusing”, which he found frustrating in the middle of an incident. OfficeChai reports that the team has since been given access to a defender tier of OpenAI’s Daybreak programme, which offers vetted security teams governed access to frontier models.

For security leaders, that is a planning point, not a complaint. If your incident response now leans on AI assistants for log triage or code review, find out before an incident whether your provider has a verified-defender route, and how long it takes to get on it. We wrote about this gated-access model in the best cyber models going behind a velvet rope. OpenCode has also had earlier security trouble this year: OfficeChai notes a critical remote code execution flaw, CVE-2026-22812, that was disclosed and patched, a reminder that AI coding tools are software with an attack surface.

6. Who should act, and how fast

If anyone on your team received OpenCode’s email, treat it as a live incident today. If your developers use OpenCode but nobody got the email, you are probably not affected, but you should still confirm, because the notice goes to individual developers and may never reach your security team. Cyera’s advice is to ask developers directly and look for Console accounts tied to company email addresses or company cards.

And if you don’t use OpenCode at all, the incident is still a useful drill. Most organisations cannot answer three simple questions about their AI keys: who owns each one, what else depends on it, and what data it can reach. That gap shows up in shadow AI surveys and in AI cost overruns, and a stolen key turns it into a bill you cannot explain.

7. The stolen-key runbook: first hour to first quarter

This runbook is ordered by time, so whoever picks it up knows what to do now and what can wait. It draws on OpenCode’s email, provider guidance and the recommendations from Cyera and The Hacker News. It is general guidance, not legal or financial advice.

First hour: revoke at the source. Log in to each provider’s dashboard directly (not through links in any breach email, which are a common phishing lure) and revoke every key that was saved in a Console workspace. For Google, create the replacement in AI Studio first, then disable the old key.
First hour: confirm the old keys are dead. Call a harmless endpoint, such as the provider’s model list, with the old key. An authentication error means it is revoked.
First hour: cap the damage. Set hard spending limits and usage alerts on every provider account. A cap does not stop theft, but it limits what one leaked key can cost.
Today: update everything that used the key. Apps, CI secrets, scripts, other agents and the Console workspace itself. Issue one new key per tool so the next revocation is surgical.
Today: read the usage logs. Go back to at least 16 October, and further if your provider allows. Look for spikes, unfamiliar models, odd hours and long reasoning-heavy requests.
Today: dispute and document. If you see charges you did not make, record them with timestamps and raise them with the provider’s support team. Keep OpenCode’s email as evidence.
This week: reset the platform layer. Change your OpenCode account password, regenerate Console API keys and remove any providers a workspace does not need.
This week: check what each key could reach. Beyond compute, a key may expose files, stored responses, prompts or fine-tuned models tied to the account. If a flagged key had that access, treat the data as possibly exposed.
This quarter: inventory every tool that holds your AI keys. Coding agents, routers, evaluation platforms and chat front ends. Give each one an owner, a separate key or workspace, a low spend limit and a rotation date.
This quarter: prefer scoped, short-lived credentials. Restrict keys to the one API they need, use per-project workspaces, and ask vendors how they store customer keys before you paste one in.

8. The bottom line

The OpenCode breach is small in raw numbers and still unexplained in its details, but it shows where AI-era credential theft is heading. Frontier model access is now valuable enough to steal for its own sake, whether to resell, to run up someone else’s bill, or to harvest outputs for a rival model. Every tool that holds your keys widens the target. Revoke at the source, cap your spend, give every key an owner and stop treating API keys as configuration. They are money, and increasingly, they are someone else’s training data.

Frequently asked questions

What happened in the OpenCode Console breach?

An intruder reached a legacy OpenCode system on the night of 16 October 2026. OpenCode says third-party AI provider keys saved in OpenCode Console workspaces, including OpenAI, Anthropic and Google keys, may have been exposed. About 1.4% of Console users were affected and were emailed on 17 October.

Are keys used with the OpenCode CLI or desktop app affected?

OpenCode says no. Keys added through the CLI or desktop apps are stored locally on the user’s machine and never reach OpenCode’s servers. Only keys pasted into Console workspaces are in scope, though rotating local keys is a low-cost precaution.

What is a distillation attack?

It is the large-scale harvesting of a commercial AI model’s outputs, against its terms, to train a competing model. Anthropic reported in September 2026 that such campaigns rely on fake accounts built partly from stolen credentials and harvested API keys. OpenCode linked its breach to a distillation attack but has not explained the connection.

I deleted my key from OpenCode Console. Am I safe?

Not necessarily. Deleting a key in Console does not revoke it at the provider, so a copy that was already taken can still work. Revoke the key in the OpenAI, Anthropic or Google dashboard, issue a new one and confirm the old one returns an authentication error.

Will I have to pay for charges I did not make?

That has not been settled. Users have reported unauthorised charges from a few hundred dollars to around $1,700, and OpenCode has not said how they will be handled. Document the charges with timestamps, raise them with the provider and keep OpenCode’s breach email as evidence.

How can businesses limit damage from leaked AI API keys in future?

Use one key per tool, set hard spending limits and alerts on every provider account, restrict keys to the APIs they need, monitor usage per key, give each key a named owner and rotation date, and ask any vendor how it stores customer keys before handing one over.