OpenCode Console breach may have exposed AI provider API keys for 1.4% of users

OpenCode, the open-source AI coding project, disclosed that a security breach may have exposed third-party AI provider API keys stored by some of its hosted Console users. OpenCode announced the incident on Saturday, October 17, 2026, tying it to a large-scale distillation attack.

What happened

According to the project maintainer, the breach affected 1.4% of OpenCode Console users who had linked external providers, with some reporting more than $1,700 in unauthorized charges overnight. The maintainer said the breach was related to a large-scale distillation attack impacting that subset of Console users, and that affected users had all been notified by email that morning. The email sent to impacted users said the earliest possible exposure of the keys was October 17, 2026, 00:30 UTC, and that no data appeared to have been exposed. Distillation is normally a legitimate technique that trains smaller AI models using responses generated by more powerful models, but it becomes an attack when it involves large-scale training through unauthorized queries.

Impact

Multiple users reported that the incident led to unauthorized API charges and suspended projects in Google Cloud. User reports described rogue charges following the key exposure ranging from several hundred US dollars up to $1,700. Some users reported that Google suspended their projects after detecting abusive activity consistent with hijacked resources.

Response

OpenCode co-founder Dax Raad said attackers had been targeting the company's systems for at least 48 hours using AI agents. He said the investigation was blocked when the AI models OpenCode was using began refusing requests due to built-in security safeguards, and that the situation stabilized after the team began using OpenAI's Daybreak AI cybersecurity model for defensive work. OpenCode said it was working with Google, OpenAI, and Anthropic to address the incident but could not share further details at that time. Its message to impacted users mentioned the possibility of reimbursement for those affected.

Lessons for security leaders

Teams that connect their own AI provider keys to a hosted console should treat those credentials as shared secrets that a vendor-side compromise can expose, since OpenCode is a model-agnostic AI coding agent through which users connect models from multiple AI providers to streamline development. Security teams should confirm whether their developers used Console with linked external provider keys, since the breach reached only that subset of users.