OpenCode Hacked: Users Urged to Revoke and Replace API Keys

Open-source AI coding tool OpenCode has confirmed a security breach that may have exposed third-party AI provider API keys stored in its Console workspaces. The company said an unauthorised party accessed a legacy system that was being decommissioned, prompting it to warn affected users to revoke their existing credentials and generate replacements. The incident came to light on October 17, 2026, with users reporting unexpected charges on connected AI accounts.

OpenCode said the breach affected 1.4% of its Console users who had linked external AI providers. The exposed credentials may include keys for services such as OpenAI and Anthropic, while the company is also working with Google in its response. Because API keys can authorise billable requests, a compromised credential can allow someone else to use an account holder’s AI services at their expense. OpenCode has advised affected users to replace their keys, update applications that depend on them and inspect recent usage for suspicious activity.

Key Takeaways

• Security breach: An unauthorised party accessed a legacy OpenCode system that was being decommissioned.
• Potentially exposed data: Third-party AI provider API keys saved in OpenCode Console workspaces may have been compromised.
• Reported scope: OpenCode said 1.4% of Console users were affected, specifically a subset with external providers linked.
• Financial risk: Users have reported unexpected AI usage charges, including a report of approximately $400 in unauthorised Anthropic usage.
• Immediate action: Affected users should revoke exposed keys through the relevant provider’s dashboard and create replacements.
• Provider response: OpenCode is working with OpenAI, Anthropic and Google.
• Investigation status: The incident was described as ongoing, and the full extent of exposure and financial losses had not been disclosed.

What Happened in the OpenCode Security Breach?

OpenCode told affected customers that it had identified unauthorised access to a legacy system that was in the process of being retired. The company warned that third-party provider keys saved in users’ workspaces may have been exposed.

The affected credentials are important because OpenCode allows developers to connect external AI services to their coding workflows. Rather than relying exclusively on a tool’s built-in model access, developers can use their own provider accounts and API keys to pay for model usage directly.

If an attacker obtains a valid key, the attacker may be able to send requests to the associated AI service, subject to the key’s permissions and any restrictions imposed by the provider. The resulting usage can appear on the legitimate account’s bill.

OpenCode’s warning therefore concerns more than access to a coding application. It involves credentials that can connect directly to paid AI infrastructure.

The company has not publicly provided a complete technical account of how the legacy system was accessed, how the credentials were stored or whether every potentially exposed key was actually used by an unauthorised party.

How many users were affected?

OpenCode said 1.4% of its Console users were affected. It described the affected group as a subset of users who had linked external providers.

The company also said it had notified affected customers by email and stated that users who did not receive the notification were not affected, according to its public communication.

However, OpenCode has not published a total number of Console users that would allow the 1.4% figure to be converted into a reliable count of affected accounts. It has also not disclosed a complete count of exposed keys or total unauthorised spending.

The percentage should therefore be understood as the company’s reported estimate of the affected share of Console users, not as a confirmed count of stolen credentials or financial losses.

Which API Keys May Have Been Exposed?

OpenCode’s customer notice specifically mentioned third-party provider keys, including those for OpenAI and Anthropic. The company’s public response also named Google among the providers it was working with.

Users have reported unexpected usage and billing activity involving multiple AI providers. These reports indicate that the incident may have financial consequences, although individual reports do not establish the total scale of the breach.

Provider or service	What is known
OpenAI	Keys saved in affected workspaces were identified as potentially exposed
Anthropic	Keys saved in affected workspaces were identified as potentially exposed
Google	The company is working with OpenCode; users have also reported unexpected usage
Other providers	The complete scope has not been publicly established

A provider API key is a credential used by software to authenticate requests. Depending on its permissions, it can allow an application to access a model or another service and generate usage charges.

The key itself is not necessarily a password for the user’s entire provider account. However, it can still be sensitive because someone who obtains it may be able to make requests under the associated account or project.

The precise level of access depends on the provider, the key’s permissions and any configured usage restrictions.

Why API Key Theft Can Lead to Unexpected Bills

Many AI services charge developers according to how much their applications use the models. Costs can depend on the number of tokens processed, the model selected, the type of request and other service-specific factors.

An attacker with a working API key may be able to send a large volume of requests in a short period. If the key is connected to a billing-enabled account, the usage can generate charges for the legitimate owner.

Users reported unexpected spending after the OpenCode incident became public. One report cited by Notebookcheck described approximately $400 in unauthorised Anthropic usage. Other reports referred to unexpected Google usage and account restrictions.

These are individual reports, not a verified estimate of the total financial damage. The company and providers had not announced a complete accounting of the incident’s losses.

A compromised key may also create operational problems. Providers can flag unusual activity, impose limits or suspend projects when usage patterns indicate abuse. Developers may then find that legitimate applications stop working until the credentials are replaced or the account issue is resolved.

The incident illustrates why API keys should be treated as sensitive credentials, even when they are used only for development or experimentation.

What Users Should Do Immediately

Anyone who saved an external provider API key in an affected OpenCode Console workspace should follow the company’s instructions and take action through the relevant provider’s official dashboard.

1. Revoke the potentially exposed keys

Open the provider’s API key management page and revoke each credential that may have been stored in the affected workspace. Do not rely solely on signing out of OpenCode or deleting a key from a local configuration file.

Revocation at the provider invalidates the credential for future use, subject to the provider’s implementation and any applicable processing delay.

2. Generate replacement credentials

Create new keys only after revoking the potentially exposed ones. Update applications, scripts and development environments that relied on the old credentials.

Avoid placing replacement keys into the same workflow until you have reviewed how those credentials are stored and who or what can access them.

3. Check recent usage and billing

Review each relevant provider’s usage dashboard, request history and billing records for activity you do not recognise. Pay particular attention to usage beginning around October 17, 2026, while checking a wider period if suspicious activity may have started earlier.

Record unexpected requests, timestamps, model names and charges. This information may help when contacting the provider’s support team.

4. Set usage limits where available

After generating replacement credentials, configure budgets, alerts, rate limits or other controls supported by the provider. These safeguards may not prevent every form of misuse, but they can help limit the potential financial impact.

Where practical, use separate keys for different projects instead of sharing one credential across multiple applications. This can make it easier to identify suspicious usage and isolate a compromised integration.

5. Update applications and check for failures

Once the new credentials are installed, verify that legitimate coding tools and applications can connect successfully. The old keys should no longer be used.

If an application stops working, check its configuration and authentication errors rather than repeatedly attempting to use a revoked credential.

Does the Breach Affect Every OpenCode User?

OpenCode’s statement points to a specific subset of Console users who had external AI providers linked. It did not say that every person using the open-source coding agent was affected.

This distinction matters because OpenCode’s locally operated coding agent and its hosted Console service are not identical. The reported incident concerns credentials saved in workspaces associated with the Console service.

Nevertheless, users should determine whether they ever saved provider keys in an affected workspace rather than assume that using the open-source tool automatically means their credentials were exposed.

OpenCode said it emailed affected users. Anyone who received the notification should follow the instructions in that message and independently verify the relevant provider accounts.

Users who did not receive an email can consult OpenCode’s official updates if they remain uncertain about their circumstances. They should avoid sharing API keys in public forums or sending them to anyone claiming to offer unofficial assistance with the incident.

OpenCode Says the Incident Is Linked to a Distillation Attack

OpenCode described the incident as related to a large-scale distillation attack. In AI, distillation generally refers to using the outputs of a more capable model to help train or improve another model.

AI providers have increasingly sought to prevent unauthorised extraction of model outputs at scale. A stolen API key could potentially be misused to generate large volumes of responses without the legitimate account holder’s knowledge.

However, OpenCode has not released enough technical detail to establish exactly how the incident unfolded, which requests were made or how the exposed credentials were used. It would therefore be premature to treat every reported unauthorised charge as definitively linked to model distillation.

The company said it was working with OpenAI, Anthropic and Google while the investigation continued. Further disclosures may clarify the method of access, the scope of exposure and whether additional safeguards are needed.

What Developers Can Learn From the Incident

The breach highlights the risks of storing third-party credentials in hosted development environments. These tools can make it easier to configure models and collaborate across projects, but they also create another place where sensitive keys may be stored.

Developers should understand which credentials a tool retains, where those credentials are kept and how access is controlled. When a service supports dedicated project keys, limited permissions and spending controls, using them can reduce the potential impact of a compromise.

Teams should also maintain a process for responding to suspected credential leaks. That process should include revoking keys, replacing secrets, checking usage logs, documenting unexpected charges and testing affected applications.

Organisations using AI coding agents may benefit from centralised secret management and regular reviews of which applications have access to provider accounts. These controls cannot eliminate every risk, but they can reduce the damage caused by a leaked credential.

The broader lesson is that AI development tools inherit many of the security responsibilities associated with cloud services. A tool that connects to multiple providers can become a valuable target because its stored credentials may provide access to several external services.

The Bigger Picture

The OpenCode breach demonstrates how a security incident at an AI development tool can create costs and operational disruption beyond the tool itself. Third-party API keys connect coding workflows to paid model services, meaning that compromised credentials can expose users to unauthorised requests and unexpected bills.

The incident also highlights the importance of clear disclosure and fast remediation. OpenCode has reported the affected share of Console users and advised credential rotation, but questions remain about the precise attack method, the number of exposed keys and the total financial impact. Those details will be important in assessing the incident fully.

Looking Ahead

OpenCode says it is working with OpenAI, Anthropic and Google as the investigation continues. A fuller incident report could clarify how the legacy system was accessed, what information was exposed and whether the company will introduce additional safeguards for stored credentials. Users should continue monitoring official communications rather than assume the issue is fully resolved.

For developers, the immediate priority is to revoke potentially exposed credentials, replace them safely and review recent provider usage. More broadly, the incident is a reminder that API keys deserve the same careful treatment as other sensitive credentials. Secure storage, limited permissions, spending alerts and a clear rotation process can reduce the consequences of future breaches.

Frequently Asked Questions

1. What happened to OpenCode?

OpenCode confirmed unauthorised access to a legacy system being decommissioned. It warned that third-party AI provider keys saved in affected Console workspaces may have been exposed.

2. Which API keys may have been compromised?

OpenCode’s notice named OpenAI and Anthropic keys, while the company also said it was working with Google. The full scope of exposed credentials has not been publicly established.

3. How many OpenCode users were affected?

OpenCode reported that 1.4% of Console users were affected. It has not published the total number of Console users needed to calculate a reliable account count.

4. What should affected users do?

Revoke potentially exposed keys through the relevant provider’s official dashboard, create replacements, update dependent applications and inspect usage and billing for unexpected activity.

5. Were users’ entire AI provider accounts hacked?

The reported incident concerns potentially exposed API keys. It does not, by itself, establish that attackers gained access to every affected user’s full provider account.

6. Has OpenCode resolved the breach?

OpenCode described the incident as ongoing in its public response and said it was working with the relevant AI providers. Users should follow official updates and complete the recommended credential rotation.