OpenCode Says Breach Exposed Some Users’ External Provider API Keys
Summary
OpenCode says a breach tied to an alleged large-scale distillation attack exposed external-provider API keys for 1.4% of Console users. Users reported unauthorized charges and suspended Google Cloud projects; the project says no other data appears exposed.
Key points
- OpenCode said 1.4% of OpenCode Console users were affected, specifically users who had linked external providers such as Anthropic, OpenAI, and Google.
- The project said the earliest possible exposure of affected users’ API keys was October 17, 2026, at 00:30 UTC, and that no other data appears to have been exposed.
- Co-founder Dax Raad said attackers used AI agents to target OpenCode’s systems for at least 48 hours in what the project described as a large-scale distillation attack.
- Users reported unauthorized API charges, including claims of more than $1,700 overnight, and some said Google suspended their projects over activity it described as consistent with hijacked resources.
- OpenCode said it was working with Google, OpenAI, and Anthropic on the incident and that it had notified affected users; its message mentioned possible reimbursement.
Article Details
- Victim Organization
- OpenCode
- Incident Type
- Security breach involving exposed API keys and an alleged large-scale AI distillation attack
- Incident Date
- 2026-10-17
- Disclosure Date
- 2026-10-19
- Data Types Exposed
- API keys for external providers
- Affected Records
- The project maintainer said 1.4% of OpenCode Console users were affected; the number of users is not disclosed.
- Operational Impact
- Some users reported unauthorized API charges, including reports of charges up to $1,700, and suspended Google Cloud projects. OpenCode said the situation stabilized after it began using OpenAI’s Daybreak AI cybersecurity model.
- Claim Status
- confirmed
People
Vendors
AnthropicOn Saturday, OpenCode announced that it suffered a large distillation attack that impacted only developers who linked external providers, including Anthropic, OpenAI, and Google.GoogleMultiple users reported that the incident led to unauthorized API charges and suspended projects in Google Cloud.OpenAIOn Saturday, OpenCode announced that it suffered a large distillation attack that impacted only developers who linked external providers, including Anthropic, OpenAI, and Google.
Products
DaybreakRaad said the situation stabilized after OpenCode began using OpenAI’s Daybreak AI cybersecurity model for defensive work, which it was approved to use on Saturday.Google CloudMultiple users reported that the incident led to unauthorized API charges and suspended projects in Google Cloud.OpenCode ConsoleAccording to the project maintainer, the breach affected 1.4% of OpenCode Console users, with some reporting more than $1,700 in unauthorized charges overnight.