OpenCode Console Leaked Provider Keys, and Its Budget Cap Could Not Stop the Bills. Here Is What to Revoke and Where.
OpenCode said on October 17 that an attacker reached a legacy system and may have exposed the OpenAI, Anthropic, and Google keys that 1.4% of OpenCode Console users had linked. Users then reported overnight charges in the hundreds and, in one case, about $1,700. Console's budgets only meter requests that pass through Console, so they could not cap a stolen key used straight at the provider. Anthropic revoked affected keys, Google blocked them, and OpenAI says it refunded. The local CLI was not involved. What to revoke, where to set limits, and what OpenCode still has not explained.
By T.W. Ghost
The first sign for most people was the bill. Overnight charges of a few hundred dollars on an OpenAI or Anthropic account, and in one reported case about $1,700, on keys that had been sitting in OpenCode Console. At 12:56 PM CT today, October 17, 2026, OpenCode posted the reason: unauthorized access to a legacy system, tied to what it called "a large scale distillation attack," that may have exposed third-party provider keys belonging to "1.4% of OpenCode Console users," specifically "a subset of users who had external providers linked." The incident, it said, "is ongoing."
Before anything else, the distinction that decides whether you are exposed. OpenCode's Dax Raad: "note this is the OpenCode Console, not OpenCode itself, those keys never come to us." OpenCode Console is the hosted gateway that stores a provider credential and serves requests through it. The local OpenCode CLI stores keys in a file on your own disk. If you only ever used the CLI, your keys were not in the system that was breached.
Then the fix, in one line: revoke the key at the provider. Deleting it from Console does nothing to a credential an attacker has already copied, and Console's budget feature, which meters requests that run through Console, never could have capped a stolen key used directly at OpenAI, Anthropic, or Google. We read OpenCode's and Dax's posts, the three provider responses, OpenCode's Console docs, and the two security-press reports. Here is what held up.
The Timeline, in Central Time
| When | What |
|---|---|
| Oct 16, about 7:30 PM | Earliest possible exposure, per the breach email as quoted by BleepingComputer (Oct 17 00:30 UTC) |
| Oct 17, 12:56 PM | OpenCode's post: legacy system accessed; 1.4% of Console users; "incident is ongoing"; working with Anthropic, OpenAI, Google |
| Oct 17, afternoon | Dax Raad: Console, not the CLI; keys "never come to us" in the local tool |
| Oct 17, 4:04 PM | Anthropic's Lydia Hallie: affected Claude API keys revoked |
| Oct 17, 5:53 PM | Google's Evan Otero: exposed Gemini keys blocked; create a new key in AI Studio; contact Google Cloud Billing about unexpected charges |
| Oct 17 | Dax offers refunds to affected users by email |
The breach email's wording, per BleepingComputer: "unauthorized access to a legacy system that we were in the process of decommissioning."
Why the Budget Did Not Help
OpenCode's own docs explain it. Console "stores the credential and serves each provider through its gateway," and budgets are checked when a request starts in Console, with models on your own providers counted "at the configured price." A key copied out of that system and used at the provider's endpoint never touches Console's budget check. The Hacker News reached the same conclusion. The cap you set in Console is a cap on Console; the bill lands at the provider, and that is where the limit has to live.
The reported amounts, each a user's own report as quoted by press, not verified individually: about $700, about $1,700, and $281 at OpenAI plus $168 at Anthropic for one developer. An earlier circulating figure of $3,000 does not appear in any report we read. OpenCode has published no count of affected users or keys and no total.
What Is Still Missing
Three things OpenCode has not said as of tonight:
- A postmortem. Root cause, dates, how many keys, and why a legacy system being decommissioned still held live credentials.
- What "distillation attack" means here. Who, what was being distilled, and how that connects to stolen keys. We do not speculate, and neither should you.
- Which "other products like ours got hit too." Dax said others were hit and that OpenCode is talking with the labs about "better protocols"; no other product is named.
The refund picture is uneven by provider: OpenCode offers refunds by email; Google points users to Billing support; Anthropic says revoked, not refunded. OpenCode is also, this month, a distribution channel for free windows on new models, which means its users skew toward exactly the multi-provider setups that got hit.
Verified vs Unconfirmed: The Scorecard
| Claim | Verdict |
|---|---|
| Oct 17 disclosure: legacy system; 1.4% of Console users with external providers linked; ongoing | Verified (OpenCode's post) |
| Console, not the local CLI; CLI keys stay on your disk | Verified (Dax Raad's post; OpenCode docs) |
| Anthropic revoked affected keys; Google blocked exposed keys | Verified (posts by Lydia Hallie and Evan Otero; titles not checked) |
| Console budgets cannot cap a stolen key used at the provider | Derived from OpenCode's own budget and provider docs; The Hacker News agrees |
| Individual bills of about $700, $1,700, $281 plus $168 | Unverified individually (user reports quoted by press) |
| $3,000 in charges | Unverified (not found in any report) |
| What the "distillation attack" was; how many keys; other products hit | Unverified (OpenCode has not said) |
| Postmortem published | Not as of Oct 17 |
What To Do
If you ever linked a provider key in OpenCode Console: revoke it at the provider console, create a new one, and check usage back to the evening of October 16 CT.
Set spend limits where the bill lands: Anthropic's usage limits, OpenAI's limits, Google Cloud billing budgets and quotas. One key per tool, so one leak costs one key.
Dispute the charges with the provider and email OpenCode for its refund offer.
If you only use the local CLI: your keys are in ~/.local/share/opencode/auth.json on your own machine and were not in this system, per Dax. Protect that file anyway.
The frontier is elsewhere: the models were not the story this week; the bearer credentials in front of them were. Our model comparison has the current standings side by side, and our Claude Code source leak post is the last time a coding tool's security was the headline.
Update, October 18, 2026
- October 18, 7:04 AM CT: Dax Raad said the attacker had been "non stop trying to attack our systems for the past 48 hours." He later said OpenCode used OpenAI's Daybreak Blue model for defense: "they did quite a bit and then started refusing," and then that "daybreak was critical (and is now continuously running)."
- October 18, 11:12 PM CT: OpenAI's Thibault Sottiaux said OpenAI worked with OpenCode to get affected API customers "back in business and any credits refunded." That is the only OpenAI statement; there is no official OpenAI page on the incident. Still no postmortem from OpenCode, and still no explanation of the distillation attack.
Sources
- OpenCode on X: incident disclosure
- Dax Raad on X: Console, not OpenCode itself
- Lydia Hallie (Anthropic) on X: keys revoked
- Evan Otero (Google) on X: Gemini keys blocked
- Thibault Sottiaux (OpenAI) on X: credits refunded
- OpenCode docs: Console providers
- OpenCode docs: Console budgets
- OpenCode docs: providers (local CLI)
- The Hacker News: OpenCode Console breach
- BleepingComputer: OpenCode hack exposes API keys
*Not sure how many provider keys your tooling is holding, or where their spend limits live? Take the free 2-minute quiz and get matched. Then read about the free-model channel that made OpenCode worth attacking this week: MiniMax M3.1 Flash.*