Skip to content
Hire an AI employee
AI EmployeeSuper-AgentsAgent-to-AgentBenchmarksPricingBlog
Guides 07 Trust, permissions & security

OpenCode Breach: Provider API Keys Exposed, What to Do

Nitish Garg · Founder & CEO, CellCog · 17 October 2026 · 7 min read · 1,602 words
At a glanceQuick answers
What happened at OpenCode?
Attackers reached a legacy system and took third-party provider keys that some OpenCode Console users had saved; OpenCode says 1.4% of Console users were affected.
Which keys were exposed?
OpenAI and Anthropic keys per OpenCode’s notice; users also reported Google spend alerts, and OpenCode names Google as a remediation partner.
What should I do?
Revoke every key you saved in Console from the provider’s dashboard, read your recent usage, and set a spend limit on the replacement.
Data illustration on a near-white ground: a teal server cabinet labeled Legacy System with its door hanging open, keys tagged OpenAI, Anthropic and Google pouring out into a navy funnel that unrolls a long amber receipt, beside a huge navy 1.4% reading of OpenCode Console users
Fig 0Keys out of a legacy system, a bill for someone else. Made by CellCog's image agent, running GPT Image 2.5.

OpenCode says attackers got into a legacy system and took the third-party API keys some Console users had saved there: OpenAI, Anthropic and Google keys, which strangers then spent on those users’ bills. In a post on X at 18:08 UTC on October 17, 2026, the company said the breach “impacted 1.4% of OpenCode Console users”. It said it had emailed every affected user that morning and that it is “working with Anthropic, OpenAI, and Google to remediate”. It described the incident as “a large scale distillation attack”.

Users found out before the post. By 14:14 UTC a customer notice titled “Action Required: Potential provider key breach” was on r/opencode, and developers on X were describing provider spend alerts going off overnight. Here is what is confirmed, what is not, and what to do if you ever saved a key in OpenCode Console.

On this page · 8 sectionsOpen
  1. What OpenCode has said
  2. How the day unfolded
  3. What a “distillation attack” probably means here
  4. Confirmed vs not confirmed
  5. What to do if you used OpenCode Console
  6. What this means if you run AI agents
  7. What we are watching
  8. Sources
Key points5 · 7 min full read
  1. A browser window divided into a grid with one small square highlighted amber.
    OpenCode said on October 17, 2026 that a breach impacted 1.4% of OpenCode Console users, all of whom had linked their own external provider keys.
  2. An open envelope with a warning triangle and a key sticking out.
    Its customer notice says a legacy system it was decommissioning was accessed and that saved OpenAI and Anthropic keys may have been exposed.
  3. A ringing bell above a long amber receipt.
    Users reported OpenAI, Anthropic and Google spend alerts overnight; only Google suspended a project on its own.
  4. Keys dropping into a funnel next to an amber question mark.
    OpenCode calls it a large scale distillation attack and says it is working with Anthropic, OpenAI and Google, without saying how the keys were used.
  5. A crossed-out old key, an amber rotate arrow and a new key.
    If you saved a key in Console, revoke it in the provider’s own dashboard, check recent usage and put a spend limit on the new key.

§ 01What OpenCode has said

Animation: a developer saves OpenAI, Anthropic and Google keys into an OpenCode Console box, a legacy system door beside it swings open, copies of the keys slide out to three provider meters that print amber receipts, then the developer presses Revoke at the provider and the copies are crossed out
Fig 1Keys saved in a tool leaked from an old system and billed the owner until revoked

There are two first-party statements, and they describe the same event from different angles.

The customer email says OpenCode “identified unauthorized access to a legacy system that we were in the process of decommissioning.” It goes on: third-party provider keys, with OpenAI and Anthropic given as examples, “saved in your workspace may have been exposed.” It asks users to “revoke and replace those keys through the relevant provider’s dashboard, update any applications using them, and review recent usage for unexpected activity.”

The post on X went up at 17:56 UTC and was edited at 18:08 UTC. It adds the scale (1.4% of Console users), says the affected group was a subset of “users who had external providers linked”, and says “The incident is ongoing so we cannot share more details at this point”. By 19:05 UTC it had 96,700 views.

What it does not give is a denominator. OpenCode Console is an optional paid service on top of the open source agent: “Sign in, add credits, and get an API key”. OpenCode publishes figures for the agent (208,000 GitHub stars and 16 million monthly developers on its homepage), but not for Console. So 1.4% cannot be turned into a number of people. OpenCode’s status page listed no security incident at 19:00 UTC, only slow responses and a request-log outage earlier in the day.

§ 02How the day unfolded

Time Event Source
14:14 Customer notice email posted to r/opencode Reddit
14:35 A developer reports OpenAI, Anthropic and Google spend alerts; Google suspends his project Chris Sinco on X
15:18 Security researcher Matt Johansen reports customers’ keys running up charges X
17:56 OpenCode posts its first statement OpenCode on X
18:08 Edited post: 1.4% of Console users, working with the three labs OpenCode on X
18:41 Dax Raad of OpenCode says his personal accounts are now being attacked too X
Table 1What happened on October 17, 2026 (all times UTC)
From the first notice to OpenCode's public statement, October 17 (UTC)Timeline of the OpenCode breach on October 17, 2026: notice email on Reddit at 14:14, spend alerts at 14:35, charges reported at 15:18, first statement at 17:56, the edited statement with 1.4% highlighted at 18:08, and the founder's personal accounts attacked at 18:4114:14Notice email on Reddit14:35Spend alerts at three labs15:18Keys running up charges17:56First OpenCode statement18:081.4% of Console users18:41Founder's accounts attackedFrom the first notice to OpenCode's public statement, October 17 (UTC)Timeline of the OpenCode breach on October 17, 2026: notice email on Reddit at 14:14, spend alerts at 14:35, charges reported at 15:18, first statement at 17:56, the edited statement with 1.4% highlighted at 18:08, and the founder's personal accounts attacked at 18:4114:14Notice email on Reddit14:35Spend alerts at three labs15:18Keys running up charges17:56First OpenCode statement18:081.4% of Console users18:41Founder's accounts attacked
Fig 2From the first notice to OpenCode's public statement, October 17 (UTC)

The clearest user account is Chris Sinco’s: “I saw my Open AI, Anthropic, and Google AI spend alerts all fire off before going to bed wondering what was going on. Though only Google went ahead and suspended the project for suspicious activity.” Of the three providers, only Google stopped the spend on its own.

Dax Raad, who runs OpenCode, added a line that says a lot about the day: “whole new world with ai powered hacking”.

§ 03What a “distillation attack” probably means here

Distillation is training a smaller model on the outputs of a stronger one. The labs treat unauthorized distillation as theft. Anthropic reported on February 23, 2026 that three labs ran “over 16 million exchanges with Claude through approximately 24,000 fraudulent accounts” (Anthropic; our record). On October 12 it said new safeguards had “reduced the amount of data harvested by distillers by around 90 to 99%”, and that distillers create accounts with false identities and “stolen payment details” (Anthropic). OpenAI described its own campaign in September (our record).

Our read, which OpenCode has not confirmed: a real customer’s API key is the account a distiller cannot fake. It is verified, it already pays, and it has a normal history, so the traffic looks ordinary and the bill goes to someone else. That would explain both halves of OpenCode’s wording, a “breach” and a “distillation attack”, and why the labs are involved. OpenCode has not said which models were queried, how many keys were used, or how much was spent. Commenters under its post asked exactly that.

Animation: a crowd of fraudulent account cards is stopped at a lab gate under a tag reading around 90 to 99% stopped, while one real customer's API key passes through and an amber receipt travels back to the customer
Fig 3Our read: labs stop fake accounts, a real paying key walks through

§ 04Confirmed vs not confirmed

Claim Status Source
A legacy system being decommissioned was accessed Confirmed Customer notice
Saved OpenAI and Anthropic keys may be exposed Confirmed Customer notice
Google keys hit too Reported by users; Google named as a remediation partner Chris Sinco; OpenCode on X
1.4% of Console users affected Confirmed OpenCode on X
No email means not affected OpenCode says so OpenCode on X
Keys used for distillation OpenCode’s description, no detail OpenCode on X
Keys stored without encryption Not confirmed; Reddit speculation r/opencode
Number of users, keys or dollars Not published None
Table 2What is on the record about the OpenCode breach, October 17, 2026

§ 05What to do if you used OpenCode Console

  1. Revoke at the provider, not in Console. Open the API keys page at OpenAI, Anthropic and Google (AI Studio or Cloud credentials), revoke every key you ever saved in OpenCode, and create new ones. Some Reddit users said they could not log into Console this afternoon; you do not need it to revoke.
  2. Read your usage for the past few days. Look for models, regions or volumes you do not recognise, and report the charges to the provider’s support with the dates.
  3. Put a spend limit on every new key. Google’s automatic suspension is what saved Sinco’s third bill. Set per-project budgets and alerts so the next leak stops itself.
  4. Update anything that used the old keys, including CI jobs and other coding agents.
  5. Did not get the email? OpenCode says you were not affected. If you linked a provider key in Console anyway, rotating it costs five minutes.

§ 06What this means if you run AI agents

Every tool that holds your raw provider key is one more copy of it you have to defend, and a tool you stopped using still holds it. This one sat in a system OpenCode was already shutting down. Give each tool its own key with its own cap, revoke the ones you no longer use, and prefer tools that never need your key at all. Our least-privilege guide for AI agents covers the rest.

§ 07What we are watching

  • OpenCode’s follow-up: the notice promises to “follow up with any updates”.
  • Any statement from Anthropic, OpenAI or Google on the keys or the distillation traffic.
  • Whether the providers refund fraudulent spend, and how many keys were involved.

§ 08Sources

Frequently asked5 questions

Q1Was every OpenCode user affected?

No. OpenCode says only a subset of OpenCode Console users who had linked external providers were affected, 1.4% of Console users, and that anyone who did not get its email was not. The open source agent alone was not named.

Q2What is a distillation attack?

Training a smaller model on a stronger model’s outputs without permission. Labs block it by catching fraudulent accounts; a stolen paying customer’s key avoids that check, which is our reading of why OpenCode used the term. OpenCode has not explained it.

Q3Do I need OpenCode Console to revoke my keys?

No. Revoke them on the API keys page of OpenAI, Anthropic and Google directly. Some users reported they could not log into Console on October 17.

Q4Will the providers refund the charges?

Nobody has said. Report the unexpected usage to each provider’s support with dates and the key, and keep the OpenCode notice as evidence.

Q5How many people were affected?

OpenCode has not published a Console user total, so 1.4% cannot be converted to a number. It has not given a count of keys or dollars either.

Published 17 October 2026 All Trust, permissions & security →