An intruder broke into a legacy system at OpenCode late on October 16, gaining access to third-party AI provider API keys that users had stored inside OpenCode Console, the company's optional hosted service. The open-source coding platform disclosed the incident on October 17 and said 1.4% of its Console users were affected, all of whom had linked at least one external AI provider to their account.
OpenCode connected the breach to what it described as "a large-scale distillation attack," a method where someone collects outputs from frontier AI models to train a separate, competing model. Rather than building costly infrastructure or licensing training data, attackers use someone else's API access to query high-end models at scale, then feed those responses into their own system. The stolen asset in this case was not personal data but model access, specifically the ability to run queries against Claude, GPT-4, and Gemini on someone else's tab.
What Got Taken and What Did Not
OpenCode co-founder Dax Raad drew a line between accounts that stored keys in Console and those that used the local CLI or desktop app. Keys saved locally sit inside a SQLite database on the user's own machine and, as Raad noted, "never come to us." Those were not touched. Only keys that users explicitly uploaded to Console, which OpenCode stores server-side to route requests through its gateway, were within reach of the compromised system.
OpenCode has not specified what the legacy system was, how long the attacker had access, or how many users 1.4% translates to in real numbers. As of October 18, Raad said the company's systems had been under sustained pressure, with attackers attempting to get in "non stop" for 48 hours.
Users Report Charges Running Into Hundreds of Dollars
Reports on X and Reddit painted a more concrete picture of the damage. One user, Colin Parsons, said his accounts had been charged $281 on OpenAI and $168 on Anthropic. Another, Preston Zeller, reported a bill of $1,700. A Reddit thread gathered additional accounts, including roughly $400 in Anthropic usage and around 200 euros in Google Cloud charges that prompted Google to suspend the associated project.
OpenCode has not confirmed these figures as part of its own findings, and it has not addressed whether affected users will be reimbursed. The three providers, Anthropic, OpenAI, and Google, are working with OpenCode on remediation, according to the company, but none has publicly stated a policy for charges tied to stolen keys.
The mechanics of the situation make quick action important. An API key works for whoever holds it. Removing the key from inside OpenCode Console does nothing if the attacker already copied it. Console's built-in spend limits also cannot cap usage that happens outside OpenCode's own gateway, which means a copied key used directly against a provider's API bypasses those guardrails entirely.
The Distillation Attack Context
The technique OpenCode referenced is not new, and its scale in recent months has drawn attention from the companies whose models are being targeted. In February 2026, Anthropic flagged industrial-scale distillation activity, naming specific actors it said had extracted outputs from its models to train cheaper alternatives. Separately, U.S. officials noted that Chinese AI companies had pulled billions of tokens from frontier models through similar methods, a practice that lets firms skip large portions of the compute and research costs normally required to reach competitive performance levels.
What makes the OpenCode breach notable in this context is the method. Rather than scraping public interfaces or using their own accounts in violation of terms of service, the attackers here appear to have acquired legitimate credentials through a third-party breach, letting them operate under real user accounts with established billing relationships. That separation from direct account creation makes automated detection harder.
What Affected Users Should Do Now
OpenCode has advised affected users to rotate their keys immediately, but the precise steps matter. Rotating a key inside OpenCode Console alone is not sufficient. Users need to revoke the key from inside each provider's dashboard, where the credential is actually authenticated, then generate a new one and update every application or script that referenced the old key. Reviewing billing history going back to at least October 16 is also advisable, as any charges from queries the user did not make would show up in the provider's usage logs, not only inside OpenCode.
Security researchers have used the incident to argue against concentrating multiple provider keys inside a single third-party tool. Storing separate keys for separate platforms limits what any single breach can reach, and using keys with restricted permissions or lower spending thresholds reduces the potential damage if one is taken.
OpenCode says the investigation is ongoing.
