OpenCode Breach Exposes Third-Party API Keys for 1.4% of Console Users

OpenCode Confirms Breach Tied to Large-Scale Distillation Attack

OpenCode has disclosed a security incident affecting a small but meaningful slice of its user base, warning that third-party API keys stored in certain workspaces may have been exposed. In a statement issued on October 17, the company said the breach impacted roughly 1.4% of its Console users and linked the activity to what it described as a large-scale distillation attack.

According to the disclosure, OpenCode is coordinating with Anthropic, OpenAI, and Google as part of its response — a detail that underscores how the incident reaches beyond OpenCode's own infrastructure into the broader ecosystem of model providers whose credentials its users had connected.

What Happened

The core of the disclosure is straightforward: API keys belonging to third parties, saved by users inside affected workspaces, may have been accessible to unauthorized parties. Because these credentials are typically long-lived and grant direct access to paid model APIs, exposure carries both financial and data-handling risk for the organizations that own them.

The company attributed the incident to a distillation attack — an activity pattern in which an adversary attempts to extract model behavior or capabilities at scale, often by driving large volumes of queries through compromised or misused credentials. While OpenCode did not publish a detailed technical timeline in its initial statement, the framing suggests the attacker's objective was access to model capacity rather than user personal data.

OpenCode has not, in the information available so far, disclosed the exact number of affected accounts, the duration of unauthorized access, or the specific vectors used to reach the keys. Those gaps are worth tracking as the investigation matures.

Why Third-Party API Keys Are a High-Value Target

For security teams, the incident is a reminder that API keys are frequently the weakest link in AI-integrated workflows. Unlike passwords, they are often pasted into configuration panels, shared across teams, and left without rotation schedules. Once a key leaks, it typically remains valid until someone notices anomalous usage — or until a provider's billing threshold trips.

A distillation attack amplifies that risk. Rather than a single fraudulent charge, the goal is sustained, high-volume interaction with a model. That pattern can look like legitimate heavy usage for a period, making detection harder for both the credential owner and the platform in the middle.

Organizations that connected provider keys to OpenCode workspaces should treat those credentials as potentially compromised, regardless of whether their specific workspace was named in the notification.

Recommended Response for Affected and Adjacent Users

Security practitioners whose teams use OpenCode's Console — or any similar AI tooling that stores provider credentials — should consider the following steps:

Rotate immediately. Revoke and reissue any Anthropic, OpenAI, or Google API keys that were stored in OpenCode workspaces. Rotation is cheap; an abused key is not.
Audit usage logs. Review provider-side usage dashboards for unexpected volume, unfamiliar source IPs, or model calls that don't map to known applications.
Check spend anomalies. Distillation activity often surfaces first as a billing spike or a rate-limit pattern rather than as a security alert.
Scope keys narrowly. Where providers support it, restrict keys to specific models, projects, or spend ceilings so a single leaked credential cannot be used broadly.
Review data exposure. If prompts or context sent through the workspace contained sensitive material, assess whether that content could have been captured during the intrusion.

The Bigger Picture

OpenCode's disclosure lands in a period of heightened scrutiny over how AI developer platforms handle secrets. The company's decision to name its coordination with Anthropic, OpenAI, and Google is notable — it signals that provider-side abuse detection and revocation play a role in containment, and that incidents at intermediary platforms are increasingly a shared responsibility problem.

The 1.4% figure is small in relative terms, but the blast radius of a leaked API key is not measured in percentages. A single exposed credential can translate into thousands of dollars in unauthorized usage, model-extraction attempts, or downstream data handling that violates an organization's own compliance posture.

For now, OpenCode has not published a full post-incident report. Affected Console users should watch for direct notification and further guidance, and everyone else should use the disclosure as a prompt to inventory where provider keys live — and how quickly they could be rotated if the answer turned out to be "not quickly enough."