OpenCode Console breach exposes OpenAI, Anthropic and Google API keys
OpenCode, an open-source AI coding tool gaining ground as an alternative to Claude Code and Cursor, said an intruder breached an older system behind OpenCode Console, its optional hosted service, on the night of October 16, exposing the provider API keys that 1.4% of Console users had stored there. The company emailed affected users urging them to revoke their keys with OpenAI, Anthropic and Google immediately, since a leaked key acts as a bearer credential, letting whoever holds it run billable requests against the owner's account until the provider itself revokes it. Users reported on Reddit and X unexpected charges ranging from several hundred to over $1,000, and OpenCode linked the incident to a distillation attack, where stolen keys are used to generate large volumes of model outputs to train another model on, though some experts question that framing. Co-founder Dax Raad said the command-line and desktop apps were unaffected, since keys stored there live locally and never reach the company's servers. For a business using such AI coding tools, the case shows why every API key deserves its own spending cap and alert, so a leak gets caught before charges run into the thousands.
Sources
This summary was written automatically with AI from the public sources listed above and checked by an independent AI reviewer before publication. For full details, read the original source.