OpenCode Reports Breach Exposing Third-Party AI API Keys for 1.4% of Console Users

OpenCode, the open-source coding tool that lets developers run models from multiple AI providers with their own credentials, said an intruder reached a legacy system it was shutting down, potentially exposing API keys stored in user workspaces for services including OpenAI, Anthropic and Google. The company put the affected share at 1.4% of OpenCode Console users.

The disclosure, posted on X and followed by an email to customers, said the intrusion was tied to a large-scale "distillation attack" — a technique in which an AI model is queried at volume so its outputs can be harvested to train a competing system. OpenCode said the incident remains under investigation and declined to release further technical details, including which models were targeted, how many queries were made or how long the activity lasted.

Only customers who had linked outside providers were affected, according to the notice. The company said it emailed every identified victim on the morning after the breach and that anyone who did not receive a message was not impacted. It added that it is working with Anthropic, OpenAI and Google on remediation.

API keys are the credentials applications use to call a provider's models, and a stolen key can be used to make requests billed to the account holder. OpenCode told recipients to revoke and replace their keys through each provider's dashboard, update any applications that rely on those credentials and review recent usage for suspicious activity. It has not disclosed the total number of accounts involved; the 1.4% figure measures the share of Console users affected, not the proportion of keys exposed.

Security commentator Matt Johansen, who tracks application-security issues, wrote on X that the breach was confirmed and that keys had been stolen, adding that customers were being told to revoke them. The company's own notice did not dispute that characterization.

OpenCode said it was in the process of decommissioning the legacy system when the unauthorized access occurred. The company did not say how long the system had remained reachable or what access controls protected the workspace credentials stored there.

Some customers reported difficulty managing the fallout. According to accounts circulating on Reddit, OpenCode service API keys expired for some users, and attempts to sign in through Google or GitHub returned an "Unable to start social login" error. Some users said a newly generated key still did not work.

The financial exposure runs through the providers' billing systems. A key that remains active can keep generating charges until its owner revokes it or the provider disables access, which means the cost of the breach depends on how quickly credentials are rotated and on what spending limits each account carries.

Distillation attacks have become a recurring concern for AI developers because they convert legitimate API access into a channel for copying a model's behavior. Providers typically respond with rate limits, usage monitoring and terms-of-service enforcement, but a compromised key can bypass account-level controls until it is detected.

The incident also puts a spotlight on the practice of storing third-party credentials inside development platforms. Tools that aggregate multiple model providers simplify switching between them, but they also concentrate keys that carry direct billing authority in a single place, widening the impact of any single system failure.

For developers and the businesses that employ them, the practical steps are the same ones OpenCode outlined: rotate every key that touched the platform, audit provider dashboards for unfamiliar usage, and set hard spending caps where the providers allow it. Security specialists generally advise treating any credential that may have been exposed as compromised rather than waiting for confirmation.

OpenCode has not said whether it has reported the incident to regulators or law enforcement, and it has not published a timeline for completing its investigation. The company said more information would follow once the matter is resolved.