OpenCode Console Breach Exposes Stored API Keys, Triggers Unauthorized AI Charges

Attackers broke into an older OpenCode system affecting 1.4% of OpenCode Console users and used stored API keys to run up charges on those users' third-party AI accounts. OpenCode disclosed the incident on Oct. 19, describing it as a large-scale distillation attack. TechCrunch

OpenCode is an open-source AI coding agent. OpenCode Console is the hosted complement to that project, an online platform where some users store API keys used to access AI services. The exposed keys were confined to Console workspaces. The open-source app and command-line tool were not affected.

Developers reported unauthorized spending alerts and charges on their OpenAI, Anthropic and Google AI accounts after the breach. Some users reported unauthorized charges in the hundreds of dollars, with a few reporting totals above $1,000. The pattern is consistent with bulk inference abuse. Stolen keys provide direct access to metered APIs, and large-scale querying can burn through credits quickly before rate limits or billing alerts trip. TechCrunch

Containment has centered on the providers. Anthropic and Google blocked API keys they believed were exposed in the breach. OpenAI worked with OpenCode to restore access and refund API customers for credits used in the attack. Refunds for unauthorized charges are underway.

OpenCode said it notified all impacted users via email on the morning after the breach. Users who did not receive a notification email were not impacted. Co-founder Dax Raad said attackers tried to break into its systems nonstop for 48 hours. OpenCode also received access to OpenAI's Daybreak Blue program, which gives vetted users AI models less likely to refuse requests for defensive security work. TechCrunch

The CLI was untouched. That distinction matters. Self-hosted agent loops that keep keys in local environment files or secret stores were outside the blast radius. Only keys persisted in Console workspaces were at risk.

The broader context here is familiar to anyone who has run shared developer infrastructure. Centralizing keys in a hosted console trades local key sprawl for a single high-value target. The trade can still be worth it, but it puts strict requirements on isolation between workspaces, encryption at rest with per-tenant keys, short-lived tokens where providers support them, and spend caps and anomaly alerts enabled by default. Provider-side revocation worked as designed in this case. The gap was detection and time to revocation while 48 hours of sustained attempts continued.

In my view, the durable fix is not to avoid hosted coding agents. It is to treat model API keys like production cloud credentials. Scope them narrowly, rotate them automatically, keep hard billing limits on development keys, and hold them outside the agent runtime where possible through a proxy or vault. Those practices add friction. They also turn a key theft from an open-ended billing incident into a contained revocation event, which is what allowed most users here to recover with refunds and reissued keys.