OpenCode alerted users on October 17, 2026, after an intruder entered an older system and exposed third-party AI keys held in OpenCode Console. The OpenCode hack touched 1.4% of coders on the hosted service who had linked accounts from OpenAI, Anthropic, or Google. Rogue queries started soon after the intrusion, causing steep overnight bills in USD [1].
How the OpenCode Hack Unfolded
The breach began on the night of October 16 when an intruder tapped an older legacy machine inside the OpenCode network. Project staff sent emails on the morning of October 17 with the subject “Action Required: Potential provider key breach” to tell users to swap their tokens [2]. As reported by Bill Toulas for BleepingComputer, the earliest window of key exposure opened on October 17 at 00:30 UTC. OpenCode said users who didn’t get an email weren’t exposed, because the incident didn’t touch accounts without linked outside AI models [1].
OpenCode is an open-source coding agent that helps coders write features and fix bugs using plain text prompts. Teams connect model providers to speed up work [1].
“We had a security breach last night related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users,” the project maintainer said in an official public statement. Code files, chat logs, and repos weren’t copied [1]. Only raw keys kept in the web tool leaked out. OpenCode co-founder Dax Raad stated on X that the group began working with Google, Anthropic, and OpenAI to trace the damage [2].
Distillation Infiltration by Automated Agents
Distillation is a common machine-learning method where teams train small, fast models using answers from larger networks. It lets builders create cheaper tools that keep high skill levels. But when rogue actors run distillation with stolen keys, it turns into an illegal scraping wave. Attackers pump thousands of prompts into paid model endpoints, leaving the key owner to pay the bills [1].
OpenCode co-founder Dax Raad said bot agents had targeted company servers for at least 48 hours before defenders slowed down the incoming rush. When the internal team started a probe to inspect the attack methods, their diagnostic tools broke because the commercial models they used began refusing prompts due to built-in safety filters. Defense operations stabilized on Saturday after OpenCode got approval to run OpenAI’s Daybreak AI security model to track the assault. That setup gave the team the clear view it needed to spot hostile calls without hitting automated guardrail blocks. Raad said the situation improved once the specialized cybersecurity model took over defensive analysis against the continuous stream of automated requests [1].
Rogue queries didn’t vanish once defense rules took effect. Raad posted on X on October 18 that attackers kept trying to breach OpenCode systems without pause across a full two-day span. He said the nonstop assault forced the team to lock down core systems, writing that “a side effect is everything is getting hardened” [2].
Console Storage Versus Local SQLite Files
To see why only a fraction of coders faced leaks in the OpenCode hack, users must look at how the tool stores secrets. OpenCode Console is an optional hosted web service where a workspace saves external keys from OpenAI, Anthropic, or Google. The console calls the model on behalf of the team so coworkers can prompt models without ever seeing the secret string [2].
Coders who use OpenCode through local terminal commands or desktop apps keep their secrets saved on their own machines in a SQLite database. Raad said on X that the leak hit “the OpenCode Console, not OpenCode itself,” and stressed that local keys “never come to us” [2].
Outside intrusions differ from software bugs that slip out during test runs. In an earlier case covered by The Hacker News, OpenAI agents leaked user images online because of internal research setup errors rather than an outside breach against stored tokens. In the OpenCode breach, hackers didn’t grab private chats or user code; instead, they took bearer tokens that gave direct billing power over linked provider accounts until owners revoked the keys [2].
Rogue Charges and Suspended Projects
An API key is a bearer credential, meaning anyone holding the string can submit paid requests to the provider. Erasing a key from OpenCode Console doesn’t stop rogue usage, and Console limits can’t cap outside traffic because the tool only tracks calls that pass through its own web gateway. The key stays live until revoked at the source [2].
Leaked keys brought swift bills to coders caught in the incident. Dealroom reported that Colin Parsons wrote on X that rogue users ran up $281 on his OpenAI key and $168 on his Anthropic key. Coder Preston Zeller said his overnight losses reached $1,700 before he could shut down the exposed token [2].
Other coders shared billing shocks on forums as charges grew. Notebookcheck reported a Reddit user who logged $400 in rogue Anthropic usage, while another coder found about €200 of Google Cloud usage before Google suspended the project [2]. Google froze the account after finding “abusive activity consistent with hijacked resources”. OpenCode’s email to affected coders, shared by Alex Spinu, said the project is checking options for repayment [1].
Steps to Contain the OpenCode Hack
The incident shows how black-hat groups hunt for AI compute tokens. Anthropic stated in September that distillation rings often rely on harvested keys, stolen bank cards, and fake accounts to pull training data. Criminal groups also resell API access on dark web boards or burn stolen balances to feed clone apps [2].
To contain the OpenCode hack, affected coders must act quickly inside their cloud accounts. Users need to revoke exposed keys in dashboards at OpenAI, Anthropic, or Google and generate clean replacements. OpenCode told coders to update all local apps, review usage logs back to October 16, and set tight spend limits on every key. Using separate keys for each tool keeps leaks small and makes odd traffic easy to spot [2].
OpenCode said it’s working with Anthropic, Google, and OpenAI to trace how the intruder broke into the older server, though the company hasn’t stated how many total keys were exposed or how many people make up the 1.4% cohort. Fast key rotation is essential [2].
- ONLINE NEWS Toulas, B. (2026, October 19). OpenCode hack exposes API keys amid AI distillation attacks. BleepingComputer. [Article Link]
- ONLINE NEWS The Hacker News. (2026, October 19). OpenCode Console breach may have exposed OpenAI, Anthropic, and Google API keys. The Hacker News. [Article Link]
