OpenCode Got Breached and Someone Else's Keys Paid for It. Here's What You Actually Need to Do

If you use OpenCode, check your email before you read the rest of this.

On Saturday afternoon OpenCode posted that it had a security breach the night before. Their words: a "large scale distillation attack" that hit 1.4% of OpenCode Console users. They say they emailed everyone affected that morning, and if you didn't get an email, you weren't in the group. The group was users who had external providers linked to their Console workspace.

The email, which security researcher Matt Johansen posted a screenshot of, is more specific than the tweet. Subject line: "Action Required: Potential provider key breach." It says OpenCode found unauthorized access to a legacy system they were already in the process of shutting down, and that third party provider keys saved in your workspace, OpenAI and Anthropic are the examples it gives, may have been exposed. It asks you to revoke and replace those keys, update anything using them, and check your recent usage for activity you don't recognize.

That last part is where the real damage is.

What a stolen API key actually costs you

An API key isn't a password to your account. It's closer to a credit card number with no spending limit unless you set one. Every request someone makes with your key bills to you, and the provider has no way to know it isn't you.

By Saturday evening, people were replying to OpenCode's post with numbers. One person said OpenAI and Anthropic keys they only ever used in OpenCode ran up over $400 overnight. Another replied with $1,700. Those are user reports, not figures from OpenCode, and I can't verify them.

Max Weinbach showed his receipts, so his I can read. His OpenAI and Anthropic balances got drained and his Google account got rate limited and partly drained. The OpenAI dashboard he posted shows 35 million tokens across 8,966 requests, with a credit balance sitting at negative $2.15. For him that's prepaid credits emptied, not a four figure invoice, which is a reminder that a spending cap is the difference between annoying and expensive. OpenCode co-founder Dax Raad posted a few hours after the announcement that his own personal accounts were being attacked too, and called it "a whole new world with ai powered hacking." Node.js maintainer Matteo Collina replied that he'd been through the same thing before and had to rotate and put 2FA on everything.

OpenCode also sent a second email that's more useful than the first. It lists every stored key by provider and last four characters, says the earliest possible exposure was October 17 at 00:30 UTC, says no other data appears to have been exposed, and admits they can't confirm whether the keys were actually used. That last line is why you have to check your own logs. They can't do it for you.

One more detail from Max's logs. The one request the attacker made on his OpenAI key was the input "请回复ok," Chinese for "please reply ok," and the model answered "ok." That's someone checking whether a stolen key works before using it. Max posted it as a hint at who's behind this. I'd be careful there. A test prompt in Chinese tells you the language someone typed in, not who they work for, and the people doing this at scale know exactly how that screenshot reads.

Here's why "distillation attack" is the label OpenCode picked. Distillation is when you train a weaker model on the outputs of a stronger one. Anthropic wrote about it in February and again last week, and said some of the groups doing it run networks of hundreds of thousands of fraudulent accounts. If that's your business, the most expensive part is paying for the frontier model output you're copying. A pile of stolen keys that bill to other people solves that problem. OpenCode hasn't confirmed that's what happened, so treat it as the most likely explanation, not a fact. But it would explain both the name and the bills.

If you got the email, do this today

1. Revoke every key you saved in the Console workspace. Don't just make a new one. Revoke the old one first, at the provider: the API keys page on the Anthropic console, the API keys page on OpenAI, and for Gemini, create the replacement in AI Studio first and then disable the leaked one.
2. Update everything that used the old key. Your apps, your CI secrets, and the Console workspace itself if you're staying on it.
3. Confirm the old key is dead. Hit the provider's API with it. A 401 means it's gone. If you still get a 200, it's still live and still billing you.
4. Read your usage logs from October 17 at 00:30 UTC onward. That's the earliest exposure OpenCode gives, and "earliest possible" is their phrase, so go back a day further if your provider lets you. Look for requests you didn't make. A tiny test prompt in a language you don't use is the tell. If the numbers look wrong, open a ticket with the provider now, not after the invoice. All three companies say they're working with OpenCode, and your case is easier to make while the incident is still open.

If you didn't get the email, OpenCode says you're fine. I'd rotate anyway if you ever saved a key in a Console workspace. It's ten minutes, and the investigation isn't finished.

One scope note. The OpenCode CLI stores keys you add with the connect command on your own machine, in a local auth file. OpenCode hasn't said anything about local keys. This is about keys saved in the hosted Console. Different thing.

What we still don't know

OpenCode's post says the incident is ongoing and they can't share more. That's a reasonable thing to say on day one. It also means a lot is still open:

• How many accounts 1.4% is. Could be dozens, could be thousands.
• How the attacker got into the legacy system, and when the access was cut off. We have a start time now, not an end time.
• Whether every exposed key was actually used, or just some. OpenCode says it can't tell.
• Who did it. Everyone has a theory. Nobody has evidence.
• Who eats the bill. Nobody from OpenCode or the providers has said.

That last one matters most to the people with four figure charges, and the honest answer is that it's up to each provider's goodwill right now.

For context, this isn't OpenCode's first security story this year. In January two vulnerabilities were disclosed, one where OpenCode started an unauthenticated local server that any website could use to run shell commands on your machine, and an XSS in the web UI. Both were fixed quickly. I don't bring that up to pile on. I bring it up because a tool that moves fast and ships constantly accumulates systems that nobody is watching closely anymore. The email literally said the breached system was one they were decommissioning. That's the part that should worry anyone who runs a service, not just OpenCode.

The habit that limits the damage next time

This won't be the last tool that asks you to paste a provider key into a web dashboard so your whole team can use it. That's a real convenience. It also means one more server holding a live key that bills your card, and every system that ever touched that key is now part of your risk, including the old ones.

Three things I'd do before pasting a key anywhere:

• One key per service. If a key only ever lived in one place, you know exactly what to revoke and whose spike that is.
• A spending cap on that key. Anthropic lets you set spend limits per workspace. Give the gateway its own workspace and a low ceiling. If someone steals it, they get your cap, not your card.
• The narrowest scope the provider offers. Google lets you restrict a key to the Gemini API only, so a leaked key can't reach the rest of your Google account.

And actually look at your usage page once in a while. "Review recent usage for unexpected activity" only works if you know what normal looks like.

I'll say the obvious part about where I stand. I build apps that run on device with no accounts, and one reason is exactly this. My apps don't hold anyone's keys, so there's nothing on my side to breach. That's not a knock on OpenCode, which is a good tool that a lot of people rely on. It's just that every service holding a secret for you is a place that secret can leak, and the only key that can't be stolen from a server is the one that never went there.

If you use OpenCode Console, go check your inbox. Then go check your usage page. In that order.

Verified October 18, 2026. Screenshots above are from X. OpenCode's statement from its X post on October 17, the first customer email posted by Matt Johansen, and the second email and dashboard screenshots posted by Max Weinbach. Co-founder post from Dax Raad on X, reply from Matteo Collina. The $400 and $1,700 figures are user replies on X and are labeled as such. Rotation steps from Anthropic, OpenAI and Google's own key docs. Distillation background from Anthropic's February 23 and October 12 posts. January vulnerabilities from the GitHub advisories (CVE-2026-22812, CVE-2026-22813). The incident is still open and the attacker's identity is unproven.