The email arrived on the morning of October 17 with a subject line that left little room for interpretation: “Action Required: Potential provider key breach.” OpenCode told a subset of its customers that someone had reached “a legacy system that we were in the process of decommissioning” the night before, and that third-party model keys saved in their workspaces may have been exposed.
The company put the figure at about 1.4% of the users of OpenCode Console, the optional hosted workspace where customers connect their own accounts at OpenAI, Anthropic and Google so that the coding agent can call those models. Console is not the same product as the command-line tool that made OpenCode popular among developers. It is the part that holds other people’s credentials on other people’s servers, which is why a small percentage is not a small problem.
OpenCode has said little beyond the notification. In a post on X the same evening it described the intrusion as “related to a large scale distillation attack” and said it was working with Anthropic, OpenAI and Google on remediation, a formulation that quietly widened the list of keys at risk to include Google’s. The company said the incident was ongoing and that it could not share more. It has not said how the attacker got in, how long the access lasted, or whether the keys were used. Dax Raad, who works on the project, wrote a few hours later that his personal accounts were being attacked as well.
Distillation is the practice of harvesting a strong model’s outputs to train or tune a cheaper one, and it is one of the reasons providers watch for unusual traffic. A stolen key is a way to do that work on someone else’s invoice. The value is not a single query but a large volume of them, run against a quota the real customer is paying for and may not examine until the monthly bill arrives. The same key can be resold, used to probe rate limits, or simply held while the attacker decides whether the account is worth more than the risk of using it.
The advice OpenCode gave its customers, rotate the keys, is correct and also easy to do incompletely. Replacing a key inside Console removes it from that workspace. It does not revoke it at the provider, and a key that has not been revoked at the provider still works. The order that matters is to create the replacement, deploy it everywhere it is used, then disable the old one at OpenAI, Anthropic or Google, and to check usage from October 16 onward rather than from the day the email arrived. Keys tend to live in more places than the console that stored them: continuous integration secrets, environment files, a colleague’s laptop, an old script that nobody has opened this year.
Nothing published so far connects this incident to the bugs that have hit the local tool. CVE-2026-22812 described an unauthenticated local HTTP server that could be made to run shell commands, rated 8.8 and fixed in version 1.0.216. CVE-2026-22813 described a markdown renderer that put raw model output into a page and allowed script execution on the local origin, fixed in 1.1.10. Both are worth knowing about, and neither explains the email. Treating them as the cause would be a guess dressed as analysis.
The pattern that the incident does illustrate is where credentials have moved. A developer tool that acts on a person’s behalf needs that person’s keys, and the convenience of syncing settings across machines pushes those keys from a local file into a hosted service. The result is a class of company that holds a large collection of high-value bearer tokens belonging to other companies, protected by one login, one session and whatever internal controls a small team has had time to build. Bearer tokens do not ask for a second factor. Whoever holds one is the customer.
Provider-side detection is the control that has to work, because revocation by the customer is the only remedy that is fully in the customer’s hands and it depends on the customer noticing. OpenAI, Anthropic and Google all publish spend dashboards and allow per-key budgets, and a key that is capped at a hundred dollars a month is a much less attractive target than an unlimited one. A dedicated key for a third-party service, scoped to a single project, is a better arrangement than the key an application uses in production. Most teams know this. Fewer have done it, because the defaults are generous and the setup takes an afternoon.
Console’s customer list is a segment of a segment, and 1.4% of it is a rounding error in the population of developers who use the tool. What those users stored was not user data or source code but the ability to spend money on models, which is the part of an artificial intelligence business that is easiest to convert into cash and hardest to claw back after the fact. The breach will be remembered less for its size than for what it says about the arrangement that hosted agents depend on: a third party holding a credential that never expires until someone remembers to cancel it.
OpenCode has not published a timeline, and the honest state of the record is that the scope is a number the company gave itself. The customers who received the email should assume the worst case for their own keys and act on it. The ones who did not receive it have been told they were not affected, which is a statement about a system that has already proved it could be entered once.
