Somebody else used your AI account this weekend — and you paid for every token. That is the nightmare thousands of developers woke up to on Saturday, October 17, when OpenCode, the hugely popular open-source AI coding agent, confirmed a security breach: attackers got into a legacy system the company was shutting down, and AI provider keys that users had saved in their OpenCode Console workspaces may have been exposed. Within hours, users were posting screenshots of drained balances and usage spikes they never made — the stolen keys, linked to OpenAI, Anthropic and Google models, were already being burned at scale.
OpenCode is not a niche tool. Built by Anomaly, its GitHub repository has roughly 215,000 stars — more than OpenAI's own Codex CLI — and the company says about 16 million developers use the agent every month. It works with models from more than 75 providers, which is exactly why its users paste in their own API keys. This weekend, for a slice of them, that convenience turned into someone else's free ride on the world's most expensive AI models.
Key Takeaways
- OpenCode disclosed on October 17, 2026 that unauthorized access to a legacy system being decommissioned may have exposed third-party provider keys — OpenAI and Anthropic named as examples — saved in some Console workspaces.
- About 1.4% of OpenCode Console users were affected, specifically the subset who had linked external providers. OpenCode says it emailed every affected user on Saturday morning; if you got no email, the company says you were not affected.
- OpenCode calls it a "large scale distillation attack": stolen keys were used to run heavy queries against frontier models on the victims' accounts. Users have publicly reported unauthorized charges ranging from a few hundred dollars to more than $1,700.
- Keys added locally through the OpenCode command-line tool were not part of this incident, according to OpenCode's account of the breach — only keys stored in Console workspaces.
- The fix is at the provider, not in OpenCode: revoke each exposed key in the OpenAI, Anthropic or Google dashboard, issue a fresh one, and check your usage and billing back to October 17.
What Actually Happened at OpenCode
According to OpenCode's disclosure, the breach happened overnight into Saturday, October 17. Someone gained unauthorized access to a legacy system that was already in the process of being decommissioned — the kind of forgotten corner of an infrastructure that security teams dread, because old systems often hold live data with none of the monitoring of the main platform. In this case, what the system held was valuable: provider API keys that Console users had saved in their workspaces so team members could use AI models without ever seeing the raw credentials.
OpenCode emailed affected customers on Saturday morning with the subject line "Action Required: Potential provider key breach," and posted a public statement that afternoon. "We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users," the project wrote on X, adding that it had notified everyone affected and was "working with Anthropic, OpenAI, and Google to remediate." The company has not shared deeper technical details, saying the incident is still ongoing. Co-founder Dax Raad added a sign of how fast this escalated: his own personal accounts, he posted, were also coming under attack — "whole new world with AI-powered hacking."
Why Attackers Wanted Keys, Not Passwords
This breach is different from the usual stolen-database story, and that difference matters. The attackers were not after your name, your email or your credit card. They were after billable access. An API key for a frontier model is a meter running on someone else's account: every prompt sent with that key is charged to its owner, whether the owner sent it or not.
That is what "distillation attack" means here. Distillation is the practice of training a cheaper model on the outputs of a stronger one — you ask the frontier model tens of thousands of carefully chosen questions and use its answers as teaching material. Done at scale, it normally costs a fortune in API fees. Done with stolen keys, it costs the attacker nothing and the victims everything. One affected user, Max Weinbach, posted that his OpenAI account had logged roughly 35 million tokens across nearly 9,000 requests in a single day, pushing his prepaid balance negative — and that Google had separately warned him one of his projects looked compromised. Other users publicly reported unauthorized Anthropic usage from around $400 up to four-figure sums. Anthropic has reportedly revoked the affected Claude keys, but no provider has announced that fraudulent charges will be refunded — which is why speed matters more than blame right now.
Who Is Affected — and Who Is Not
OpenCode's own line is clear, and it is worth repeating exactly because rumors are already outrunning it. The affected group is about 1.4% of Console users — only those who had linked external providers inside a Console workspace. Every one of them, the company says, received the warning email on Saturday morning. If you use OpenCode but never stored a provider key in Console, or you connected your providers locally in the terminal tool, OpenCode says your keys were never in the exposed system and you were not impacted.
The catch is the word "may." OpenCode has said the saved keys "may have been exposed," and it cannot confirm for any individual user whether their key was actually taken or used. That uncertainty is precisely why the advice below applies to everyone who got the email — even if your usage graph still looks normal. A copied key does not stop working because you deleted it from OpenCode; it only dies when you revoke it at the provider. It is the same lesson we covered when an OpenAI agent spent money from a wallet it did not own: in the agent era, whatever a credential can reach, someone — or something — can spend.
✅ If You Got the Breach Email: Do This Now
- Revoke at the provider, not in OpenCode. Open the OpenAI, Anthropic or Google Cloud dashboard yourself — typed in your browser, not through any link in an email — and revoke every key you ever saved in a Console workspace. Removing a key from OpenCode alone does nothing to copies already taken.
- Issue fresh keys and update every app that used the old ones, then confirm the old key is truly dead by checking that requests with it are rejected.
- Audit usage back to October 17. Review token usage, request counts and billing in each provider account for spikes you do not recognize, and screenshot anything suspicious before you contact support.
- Set a hard spending limit and usage alerts on every provider account, so a stolen key hits a ceiling in dollars, not in days.
- Use separate keys per tool. One key for one service means one revocation kills one problem — a shared key turns a small breach into a full shutdown.
⚠️ Scam Warning: The Fake Breach Email Is Already the Next Attack
Every public breach spawns a second wave, and this one is tailor-made for phishing. Developers are expecting an urgent email about their API keys — which makes a fake "Action Required" message, with a link to a lookalike provider login page, the easiest credential theft of the month. Remember the ground rules: OpenCode and the providers will never ask you to enter your password or full key on a page you reached from an email link. Revoke keys only inside a dashboard you opened yourself. The real notification does not need you to "verify" anything — it needs you to act inside your own account. Treat any text, DM or email offering a "breach compensation claim form" the same way: no such form exists, and no refund process has been announced by OpenAI, Anthropic, Google or OpenCode.
The Bigger Lesson for Anyone Who Uses AI Tools
Strip away the drama and this story is about where we now keep our most sensitive digital valuables. For twenty years the crown jewels were passwords. In 2026 they are API keys, agent credentials and wallet permissions — secrets that do not just open a door, they spend money while they are inside. The pattern rhymes with the coding-model race we covered yesterday around DeepSeek's new Flash release: frontier AI is valuable enough that stealing access to it has become an industry of its own.
The habits that protect you are boring and they work. Keep keys and recovery codes out of plain notes and chat threads. Store the documents and private notes that hold credentials somewhere built for it — Pro Calculator Secure Vault keeps photos, videos, audio, documents and private notes behind sign-in protection with local on-device storage and no data collected or shared with third parties, which is a far safer home for a scanned ID or a credentials note than a gallery or an email draft. And audit what your agents can reach: every tool you connect a key to is a door you are responsible for locking.
Frequently Asked Questions
Was my OpenCode account hacked?
Only if you were in the roughly 1.4% of Console users who had linked external providers and received OpenCode's "Action Required: Potential provider key breach" email on October 17–18. OpenCode says users who received no email were not affected, and keys connected locally through the command-line tool were not part of the incident.
What should I do if my API key was exposed?
Revoke it immediately inside the provider's own dashboard — OpenAI, Anthropic or Google — then create a replacement, update every app that used the old key, and review your usage and billing from October 17 onward for charges you do not recognize. Also set a spending limit so any future abuse stops at a dollar ceiling.
Will OpenAI or Anthropic refund the unauthorized charges?
No provider has announced refunds so far. Anthropic has reportedly revoked the affected Claude API keys, which stops further abuse but does not by itself reverse charges already made. If you find fraudulent usage, document it with screenshots and contact the provider's support directly — outcomes may vary case by case.
What is a distillation attack?
It is using a powerful AI model's answers to train or improve a cheaper model. Because serious distillation takes millions of queries, doing it with stolen API keys lets attackers shift the entire bill onto the keys' owners — which is why OpenCode users saw sudden, large usage spikes.
Is OpenCode still safe to use?
OpenCode says the breach involved a legacy Console system, not the local tool, and that the incident is still being investigated with the providers. The open-source agent itself was not reported compromised. As with any tool that holds credentials, the safe pattern is separate keys per service, spending limits on, and revocation the moment anything looks off.
The Bottom Line
The OpenCode breach will not be the last of its kind — it is arguably the first big one of a new kind. The stolen asset was not personal data; it was spending power over the world's smartest machines, and it was converted into value within hours. For US developers, the response window is still open: revoke first, audit second, argue about refunds third. And for everyone building on AI agents this year, the rule is now written in other people's invoices — a key you cannot instantly kill is a risk you have already accepted.
That same keep-it-local instinct is worth applying to your phone. Pro Calculator Secure Vault protects photos, videos, audio, documents and private notes with sign-in protection, an intruder selfie and an incognito private browser, alongside 8 smart calculators (standard, floating, BMI, age, currency, tip, GST & VAT, loan EMI) — all stored locally on your device, with no data collected or shared with third parties. See more from the maker on the ZAS developer page on Google Play.
No comments:
Post a Comment