OpenCode breach exposes saved provider API keys, and the mechanism is still unexplained

OpenCode, the open-source coding agent, told some hosted Console users on October 17 that third-party API keys saved in their workspaces may have been exposed. The company puts the affected group at 1.4% of Console users, "a subset of users who had external providers linked."

What the company has confirmed

The post on X says OpenCode "had a security breach last night related to a large scale distillation attack." Everyone affected was emailed that morning; those who received no email were not impacted, and the incident is "ongoing," so more detail cannot be shared. It is working with Anthropic, OpenAI and Google to remediate.

The email is narrower than the post. Recipients quote it describing "unauthorized access to a legacy system that we were in the process of decommissioning," with provider keys in the workspace that "may have been exposed," naming OpenAI and Anthropic. It asks users to revoke and replace the keys in each provider's dashboard and review usage.

What nobody has established

There is no entry point, no dwell time, no count of keys. Cyera's writeup notes that OpenCode has not said how the keys were stored and cannot yet confirm misuse. The mechanism is unexplained: distillation means training a model on another model's outputs, and a stolen provider key is a billing problem, not by itself a way to run that campaign.

Damage reports exist, all self-reported. Notebookcheck, citing the r/opencode thread, reported one user with $400 in unauthorized Anthropic charges. Dealroom reported others at $281, $168 and $1,700. OpenCode has published no loss figure and has not promised reimbursement.

Why the Console service matters

Console is the optional hosted layer that keeps a team's provider keys server-side, a different risk from running the local CLI with your own keys. As one r/LocalLLaMA commenter put it, "There's a very big difference between a public Internet service and an application like a harness." The user wren6991 read the framing as misdirection: "they want to move the focus to 'bad guys being bad' instead of 'hey why were you breached?'"

Deleting a key inside OpenCode does not kill a copy already taken. Revoke and reissue at each provider, update every consumer, then check billing from October 16 for unfamiliar models or odd hours. Console budgets only cover spend routed through OpenCode.

The wider month

Fireworks AI published a bulletin on October 9 saying it identified unauthorized use of internal credentials on October 6 that reached environment variables in evaluation jobs, capturing API keys "stored as secrets" for a limited number of accounts. Dealroom reported that Anthropic revoked affected Claude API keys. No one has publicly attributed the OpenCode intrusion.

OpenCode says a fuller account will follow once the incident closes. Until then: if the email arrived, treat the key as compromised.