OpenCode Console Breach: 1.4% of Users' API Keys Possibly Exposed in 'Large-Scale Distillation Attack'

This Saturday, October 17, was a rough one for the AI coding world. OpenCode, the open-source coding agent, admitted on its official X account that a security incident the previous night — tied to what it called a "large scale distillation attack" — may have exposed the third-party model API keys of about 1.4% of OpenCode Console users. Those keys connect directly to billed accounts at OpenAI, Anthropic, Google and others. In other words, whatever the attackers burn isn't OpenCode's money. It's yours.

This is not a drill. Before the disclosure, users were already posting bills on X: one saw $281 of usage pounded through an OpenAI key and $168 through an Anthropic key overnight; another reported $1,700 in losses; yet another had an OpenAI account suspended outright. OpenCode co-founder Dax Raad posted that his own personal accounts were being attacked too: "my personal accounts are being attacked now too … whole new world with ai powered hacking."

If you've ever plugged your own provider keys into OpenCode, here's what happened, why a "distillation attack" wants your keys, and the four things you need to do right now.

1. A 48-hour reconstruction: from mystery charges to official admission

The timeline, in US Eastern Time:

Late October 16: attackers gained unauthorized access to a "legacy system" at OpenCode — one the company says was "in the process of decommissioning." A system that should have been retired, but wasn't fully gone, still holding users' third-party provider keys saved in their workspaces.

Early October 17: the anomalies surfaced. User Colin Parsons posted on X (before OpenCode had said anything publicly) that his OpenAI key had been "pounded" for $281 of usage starting at 2 a.m. ET, and his Anthropic key for $168. He stressed both keys were used only inside OpenCode. Preston Zeller then reported $1,700 in losses; Francisco Giancarelli said he saw "over 700 in openai usage before I pulled the plug"; Alejandro García Iglesias reported stolen API credits plus a suspended OpenAI account. The Latent notes it could not independently verify these self-reported figures — but multiple independent reports pointing at the same pattern carry weight.

Morning of October 17: affected users received an email from OpenCode with the subject "Action Required: Potential provider key breach." Security writer Matt Johansen shared the message on X. Its key line: someone had gained "unauthorized access to a legacy system that we were in the process of decommissioning," and keys "saved in your workspace may have been exposed." Users were told to revoke keys through each provider's dashboard and watch for unexpected usage.

Afternoon of October 17: OpenCode's official X account went public: "We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users." Everyone affected had been emailed that morning — "if you did not get an email you were not impacted." The incident was still under investigation, no further details for now, and the company said it was working with Anthropic, OpenAI and Google on remediation.

Evening of October 17: two notable responses. Co-founder Dax Raad said his personal accounts were under attack too. And Lydia Hallie, who works on Claude Code at Anthropic, said Anthropic had revoked the Claude API keys it believes were affected. Raad then drew a critical boundary: this breach concerns OpenCode Console, not the OpenCode agent itself — "keys used in the agent never reach the company."

2. What a "distillation attack" is actually stealing

Distillation is a standard term in AI: training one model on the outputs of a stronger one — learning by copying. OpenCode's framing implies this chain: attackers take users' provider keys → hammer flagship models from OpenAI, Anthropic and Google at high volume → stockpile the responses to train their own models.

But there's an unexplained gap in the official story: OpenCode has not explained how it linked the key leak to a "large scale distillation attack." Did the attackers declare their intent during the intrusion? Or did OpenCode spot a classic distillation traffic pattern — high-frequency, batched, multi-task queries? As The Latent's reporting points out, that link is asserted, not evidenced. Until OpenCode discloses more technical detail, treat the "distillation attack" label with a question mark — it may be an accurate picture of the attack, or a narrative choice that frames the incident as an industry-wide problem.

Why the label matters: it determines what you're defending against. If the goal really is distillation, stolen keys aren't valuable for "sending a few messages as you" — they're valuable for sustained, massive calls to frontier models. That's exactly why bills explode: distillation needs enormous query volumes, and every query burns your money. That's how Parsons' key racked up $281 between 2 a.m. and morning.

The bigger backdrop: the distillation arms race went white-hot this month. On October 13, Anthropic upgraded its anti-distillation defenses, claiming interception volumes down 90–99% and tens of thousands of accounts banned, publicly naming Z.ai (we covered it on October 14). In September, US agencies accused six Chinese firms, including DeepSeek and Moonshot AI, of extracting billions of tokens from American models to train their own. OpenAI has said a Moonshot-linked group tried to extract reasoning traces before it shut the campaign down in July. The OpenCode incident is the first time this war has reached individual developers' wallets — it used to be labs fighting labs; now it's your API bill bleeding.

3. Console vs. agent: one word apart, worlds apart

Raad's clarification deserves its own section, because it determines who should panic.

OpenCode has two layers: the open-source agent itself (running in your terminal, editor or desktop app, keys staying on your machine) and Console (the hosted layer where teams share models, set budgets and connect their own provider accounts — keys stored on OpenCode's servers). This breach hit the latter. Raad's words: keys used in the agent never reach the company.

So the self-check is simple: if you only ever entered keys in the local agent and never used Console or synced keys to a workspace, you're out of scope. Conversely, if you ever connected an external provider in a Console workspace — even just to try it — check whether you received that "Action Required" email. OpenCode's stated position is "no email = not affected," a commitment written into its public statement. Don't treat it as insurance, though: emails land in spam folders; the usage records in your provider dashboards are the hard evidence.

The harsher judgment: any coding agent that holds your provider keys for you is, in effect, a credential store — whatever the marketing copy says. Console-style hosted layers exist to centralize key storage so teams can share models and budgets; centralized storage means a single failure leaks in bulk. That's not OpenCode's unique sin — it's a structural risk shared by every agent tool that "manages keys for you." When choosing tools, that question deserves the same priority as "how many models does it support."

4. Four things to do right now, in order

Security firm Cyera published a checklist after the incident. Here it is, adapted with the official guidance:

First, revoke and reissue every key you ever connected in Console. Do it directly in the OpenAI, Anthropic and Google dashboards — never through links in an email (phishing emails impersonating "OpenCode security notices" are all but guaranteed after this).

Second, read your billing and usage logs back to October 17. Unauthorized use shows up in usage logs before it shows up on invoices. Look for anomalous spikes from late October 16 through all of the 17th.

Third, set spending limits on every provider account. Cyera puts it bluntly: if you'd had limits in place, this would have cost you $100 instead of $10,000. Both Anthropic and OpenAI support per-key or per-organization caps. Pick a number you can stomach — a leaked key goes from "catastrophe" to "incident."

Fourth, update every pipeline, CI job and local config that used the old keys. Otherwise you'll spend next week debugging 401s. Pay special attention to key copies hiding in CI secrets, Docker env files and shared team docs.

OpenCode still hasn't disclosed: the exact number of affected users (only the 1.4% ratio), how the attackers got in, how the keys were stored (plaintext? reversibly encrypted?), whether stolen keys were actually used, or whether victims will be reimbursed. Those gaps await the investigation. For now, the four steps above are the only things in your control.

5. Three judgments for vibe coders

Key management is becoming a required course in vibe coding, not an elective. It used to feel safe because "my key only lives on my machine." Now the agent toolchain keeps getting longer — local agent → cloud console → team sharing → CI integration — and every extra stop widens the attack surface. After this incident, tier your keys by blast radius: keys for experimental tools get their own low-limit, regularly rotated credentials; production keys go only into the smallest set of tools you trust.

Watch the "distillation economy" as a new variable. The classic stolen-key playbook was crypto mining and spam. Now there's a third act: your key as someone else's free compute and free training data. That reprices keys on the black market — frontier-model keys are worth more than before, and targeted theft against developers will only grow. Anthropic's October 13 anti-distillation upgrade and this incident are two sides of the same coin.

When evaluating an agent tool, ask one more question: where exactly do my keys live? Local-first, open-source and auditable, support for bringing your own secret management instead of parking keys on a vendor's servers — these used to be nice-to-haves. They're requirements now. Raad's line — "keys used in the agent never reach the company" — effectively draws the industry's line: every hosted feature that can't meet it is a potential OpenCode Console waiting to happen.

The investigation is ongoing and OpenCode has promised updates. We'll follow up — especially on the two critical gaps: the attack technique and how the keys were stored. New developments will be reported here first.