OpenCode API-Key Breach: A Console Intrusion Turned Into Rogue AI Bills

The bill arrived before the explanation

For startup founder Colin Parsons, the warning was financial: roughly 50 emails and $449 in Anthropic and OpenAI charges by morning, according to The Wall Street Journal. The newspaper connected his experience to credentials apparently obtained through OpenCode. That is an individual reported loss, not an audited total for the incident or evidence that every exposed key was abused. ^[4]

OpenCode disclosed on October 17 that a breach affected 1.4% of users of OpenCode Console. It said affected users had been notified by email and that it was working with Anthropic, OpenAI and Google. Its announcement described an ongoing incident, not a completed forensic accounting. ^[1]

What was compromised—and what was not

Console is the hosted connection point at the center of this story. OpenCode's documentation explains that workspace administrators can save provider credentials there; its gateway then lets members use those models without seeing the underlying key. The model provider bills the account owner directly for that usage, rather than deducting Console credits. ^[6]

Co-founder Dax Raad distinguished the Console exposure from OpenCode itself, saying locally configured keys never reach the company. The incident therefore should not be described as a compromise of every developer's local coding agent. The disclosed boundary is important: a hosted credential store and a local installation are different trust relationships. ^[2]

A legacy-system intrusion, with key details still missing

The Hacker News reported that an intruder reached a legacy system on the night of October 16, followed by notification emails the next morning. OpenCode's public notice linked the breach to a large-scale distillation attack. That is the company's characterization; the public record cited here does not establish who attacked the service or demonstrate that stolen keys trained a rival model. ^{[1] [3]}

The initial entry technique, storage protections and absolute number of affected users were not disclosed in that reporting. The 1.4% figure cannot responsibly be converted into a victim count without the Console population. Nor should unrelated OpenCode vulnerabilities be presented as the confirmed route into this system. ^[3]

What affected users should do now

TechCrunch reported that Anthropic and Google blocked suspected exposed keys, while OpenAI restored access and refunded affected API credits. ^[5]

Affected users should revoke the old credential in the provider's dashboard, generate a replacement and update applications using it. Review usage and billing for unfamiliar activity. Merely removing a key from Console is not equivalent to revoking the credential that an attacker may already possess. ^{[3] [7]}

For the longer term, Anthropic recommends separate keys for different purposes, regular usage review and appropriate spending controls. The practical lesson is not that every AI coding agent is breached: handing a third party a reusable provider key creates another place where access to a billable account must be protected. ^{[6] [7]}