OpenCode says a security breach exposed stored API keys for a subset of users who linked outside AI providers, and some victims report unauthorized charges and suspended Google Cloud projects. The company said 1.4% of OpenCode Console users were affected, with earliest possible key exposure on October 17, 2026 at 00:30 UTC. OpenCode described the intrusion as a large-scale AI model distillation attack, meaning attackers abused model queries to harvest outputs or value at scale; no user data exposure has been confirmed.
Why it matters: Affected users may face direct financial loss and abuse of their linked cloud or AI accounts, so this is urgent for anyone who connected provider keys to OpenCode. Users should rotate exposed OpenAI, Anthropic, and Google keys immediately, review billing and cloud activity, and check for provider notices or project suspensions.
Bill Toulas
2026.10.19
100% relevant
This article establishes a distinct breach event centered on OpenCode’s exposure of users’ linked API keys and the resulting unauthorized charges and cloud abuse.
← Back to all stories