OpenCode Console breach exposed API keys stored by 1.4% of users

What happened

OpenCode, the company behind an open source AI coding agent, disclosed on Saturday that attackers broke into one of its older systems overnight. According to a report on dev.to, the intrusion affected 1.4% of users of OpenCode Console, the company's hosted platform where some developers keep the API keys they use to reach AI services.

The company emailed everyone affected that same morning and said users who received no email were not impacted. OpenCode is still describing the incident as ongoing.

What was exposed

The exposed credentials were confined to Console workspaces. Co-founder Dax Raad told dev.to that the open source application and the command-line tool were unaffected, and that keys used through those channels never reach OpenCode in the first place.

The practical damage showed up quickly in billing. Developers reported overnight spend alerts from OpenAI, Anthropic and Google, with some single accounts showing charges in the hundreds of dollars and a few exceeding $1,000. Anthropic and Google blocked the keys they believed were exposed. OpenAI said it worked with OpenCode to restore access and will refund its API customers for credits consumed during the attack, while OpenCode says refunds for unauthorized charges are in progress.

An unexplained framing

OpenCode linked the incident to what it called a large-scale "distillation" attack, but did not explain how the intrusion related to that concept. As dev.to notes, skeptics have pushed back on the framing, arguing this was simply a breach and that any use of stolen keys for distillation remains unproven. The company has also not said how the attackers got into the older system, how the keys were stored, or how far the misuse spread.

Affected users have been instructed to revoke their keys and issue replacements directly with each provider.

When defensive AI refuses to cooperate

A separate detail from the incident may matter beyond OpenCode. Raad said attackers had been probing the company's systems continuously for 48 hours, so the team kept AI defensive agents running around the clock. The models used to analyse the attack were helpful at first, then started refusing once the malicious code they were examining tripped their safety filters.

OpenCode later gained access to OpenAI's Daydream-adjacent program for vetted users — Daybreak Blue, in dev.to's account — which provides models less likely to decline defensive security work. Raad said that improved the team's ability to investigate.

There is precedent for the problem: dev.to points out that Hugging Face reported in July that commercial models had blocked it from analysing logs taken from an intrusion of its own.

What affected users should do

• Establish whether anyone on the team used OpenCode Console and whether they received the notification email.
• Revoke and replace any key stored there, directly with each provider.
• Review provider billing for unexpected usage and enable spend alerts where they are not already on.
• Take inventory of where other provider keys sit inside third-party hosted tools.

Why it matters

This is a concrete case of a familiar risk: any hosted tool that stores provider API keys becomes both a target and a single point of failure. OpenCode's core open source agent and CLI were safe precisely because keys never leave the developer's machine, which makes the Console's convenience the expensive part of the story.

Two broader lessons stand out. First, incident response details still matter: without an explanation of the entry vector, key storage method or scope of misuse, affected users and observers are left judging the company on framing rather than facts. Second, the refusal problem is now operational, not theoretical. Security teams leaning on AI to analyse live attacks can lose that help at exactly the wrong moment, and vendors are starting to ship workarounds for their own safety filters. Expect that tension between defensive utility and model safety to keep surfacing as AI-assisted incident response becomes standard practice.