Overview
- OpenCode said attackers reached a legacy Console system overnight on Saturday, October 16–17, and that about 1.4% of Console users who stored external provider keys may have had those keys exposed.
- The exposed credentials were limited to keys saved in hosted Console workspaces and did not include keys kept locally in OpenCode’s desktop or command-line apps.
- Anthropic and Google moved to block keys they believed were compromised and OpenAI worked with OpenCode to restore access and refund abused credits, but several users still report unauthorized charges and suspended cloud projects.
- OpenCode characterized the incident as tied to a large-scale distillation campaign that automates high-volume queries to harvest model outputs for training rival models and said its team ran defensive AI agents for roughly 48 hours to stop the activity.
- OpenCode and the providers advise affected users to revoke and replace any keys saved in Console, check provider billing for suspicious usage, and apply per-key restrictions and spend limits while the breach investigation and system hardening continue.