OpenCode Console was breached on Oct 17, exposing linked OpenAI, Anthropic and Google keys. Users report charges up to $1,700. What happened, who is affected and how to respond.
Table of Contents
Overnight on October 16-17, 2026, attackers got into an older system behind OpenCode Console. That's the hosted dashboard where teams using the open-source AI coding agent can store their own OpenAI, Anthropic and Google API keys. By morning those keys were running up model charges on accounts whose owners were asleep.
OpenCode disclosed the incident on Saturday, October 17, on X: "We had a security breach last night related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users. We have notified them all this morning via email." The email, subject line "Action Required: Potential provider key breach", said the company had found "unauthorized access to a legacy system that we were in the process of decommissioning", and that third-party provider keys saved in a workspace "may have been exposed". According to BleepingComputer, the earliest possible exposure was October 17 at 00:30 UTC.
OpenCode matters here because it has become a common open-source alternative to Claude Code and Cursor. It is model-agnostic and runs in a terminal, a desktop app or an editor. Its own site claims 208,000 GitHub stars and 16 million monthly developers, figures the company reports itself.
The breach is narrower than the headline "OpenCode hacked". Console is an optional hosted service. A workspace saves its provider key there, and Console makes the calls so teammates can use the models without ever seeing the key. Only Console workspaces that had linked an external provider were affected, and OpenCode puts that at 1.4% of Console users. If you did not get the email, the company says you were not affected.
Co-founder Dax Raad was explicit about the boundary: "Note this is the OpenCode Console, not OpenCode itself, those keys never come to us." TechCrunch reports the open-source app and command-line tool were not affected. The CLI keeps credentials locally in ~/.local/share/opencode/auth.json, and OpenCode has given no sign that those files were touched.
The first sign for many developers was their billing alerts. "I saw my Open AI, Anthropic, and Google AI spend alerts all fire off before going to bed wondering what was going on," one wrote on X. Users reported unauthorized charges from several hundred dollars up to about $1,700 per account overnight. Those numbers come from users, not from OpenCode. Some also said Google suspended their Cloud projects for "abusive activity consistent with hijacked resources", so on top of the bill, their own production workloads went down.
The providers did not all respond the same way. Anthropic and Google blocked the keys they believed were exposed. OpenAI said it worked with OpenCode to restore access and would refund API credits used in the attack. OpenCode says refunds for the unauthorized charges are underway. As of October 19, 2026, neither Anthropic nor Google had been reported promising refunds.
Distillation is a normal machine-learning technique: you train a smaller model on the outputs of a stronger one. It becomes an attack when someone harvests those outputs at scale through queries they are not authorized to make. Stolen keys suit that well. Someone else pays for the volume, and TechCrunch notes that leaked keys can also give access to people in countries where American models are restricted.
But "distillation attack" is OpenCode's own description, and the company has not said how it reached that conclusion. Some observers, including AI researcher Nathan Lambert, called the framing a stretch. On their reading, this is an ordinary credential breach, and nobody has shown the output went into training a model.
The second half of the story is why it travelled beyond security circles. Raad said attackers had been trying to break into OpenCode's systems nonstop for 48 hours using AI agents, and his team had to keep defensive agents running around the clock. The frontier models they used for analysis helped for a while. Then they stopped: the malicious code they were asked to examine tripped safety filters, and they refused. Raad called it "a bit frustrating".
Things improved once OpenCode was approved on Saturday for OpenAI's Daybreak Blue program, which gives vetted defenders models that are less likely to refuse security work. David Sacks, co-chair of the President's Council of Advisors on Science and Technology, put it bluntly: "frontier models refused to analyze the very exploits needed for defense because the payloads tripped safety filters. The guardrails backfired."
This has happened before. In July 2026 Hugging Face reported the same wall while it was analysing an intrusion by autonomous agents, and wrote that guardrails "cannot distinguish an incident responder from an attacker". Two public cases in three months make one practical point for a security team: get approved for a defensive-access program before an incident, not in the middle of one.
If you saved an OpenAI, Anthropic or Google key in an OpenCode Console workspace, treat it as compromised whether or not the email reached you. A key that is still valid costs money every hour it stays live:
The broader lesson applies to any hosted dashboard that holds your provider keys, not just OpenCode's. Every such service is one more place your key can leak from, and the bill lands on you, not the service. Where a tool supports it, give it a key scoped to one project with its own low cap, so a leak costs tens of dollars rather than $1,700.
As of October 19, 2026, OpenCode had published no post-mortem. It has not said how the attackers got into the legacy system, how the keys were stored there, or how much misuse there was in total. It described the incident as ongoing and said it is working with Google, OpenAI and Anthropic. The breach landed the same night OpenCode made GLM-5.3-Flash free for users. No report links the two.
It also comes in a busy month for AI-assisted intrusions. CrowdStrike said earlier in October that a China-based actor likely used an AI penetration-testing agent and Claude against South Korean banks, and India's CERT-In warned that AI agents had reached Indian organisations' systems without authorisation. The OpenCode incident adds a cheaper version of the same pattern: no exploit chain needed when someone else's API key will do.