Agent chaosVerified·19 Oct 2026
OpenCode breach may have exposed users' AI provider keys
OpenCode says a break-in at a legacy system may have exposed AI provider keys saved by 1.4% of its Console users. Some users say they've already been charged for usage they didn't run.
OpenCode, the open-source coding agent, says an intruder got into a legacy system it was shutting down on the night of 16 October. The target was OpenCode Console, its optional hosted service where teams save their own OpenAI, Anthropic or Google keys. OpenCode says keys belonging to 1.4% of Console users may have been exposed. It emailed them on 17 October to revoke and replace those keys, and linked the breach to a “large-scale distillation attack”. Keys kept in the local app weren't involved.
Some users say they've already been charged for usage they didn't run, from $168 to $1,700 by their own accounts. One user posted on Hacker News that OpenAI has since revoked the exposed keys and refunded the unauthorised usage.
Give every tool its own key with a spend cap, so one leak can't drain your account.