Threat reportData BreachTL-2026-3942
OpenCode Console breach exposes linked AI-provider API keys amid large-scale distillation attack
OpenCode Console breach exposes linked AI-provider API keys (TL-2026-3942), also tracked as OpenCode Console breach, is a high-severity data breach, first published 2026-10-20. It has no confirmed attribution, affects OpenCode OpenCode Console (hosted workspace service, legacy system), maps to 5 MITRE ATT&CK techniques (T1078.004, T1119, T1496.004), and is covered by 9 detection rules and 8 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-3942
- Threat ID
- TL-2026-3942
- Also known as
- OpenCode Console breach, OpenCode provider key exposure
- Severity
- HIGH
- Status
- ACTIVE
- Category
- DATA_BREACH
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in OpenCode Console breach exposes linked AI-provider API keys
Malware and tooling: Daybreak blue (OpenAI defender cybersecurity tier)
How OpenCode Console breach exposes linked AI-provider API keys works
An intruder reached a legacy OpenCode Console system on the night of 2026-10-16, potentially exposing third-party AI-provider API keys (Anthropic, OpenAI, Google) saved by about 1.4% of Console users. OpenCode attributes the activity to a large-scale distillation attack run with AI agents; affected users reported unauthorized charges from hundreds of dollars to over $1,700.
OpenCode, an open-source AI coding agent, disclosed a security incident affecting its hosted OpenCode Console, not the OpenCode CLI or desktop applications. Co-founder Dax Raad stated that keys stored locally by the CLI and desktop apps (in local SQLite databases) 'never come to us' and were not affected. According to The Hacker News, an intruder accessed a legacy system on the night of 2026-10-16. Secondary reporting (OrcaRouter, unverified) describes it as a legacy Console system being decommissioned. Third-party AI-provider API keys that users had saved in the Console (OpenAI, Anthropic, Google Cloud) may have been exposed. Only Console users with an external provider linked were affected, about 1.4% of Console users.
OpenCode characterized the activity as a 'large-scale distillation attack': harvesting large volumes of model outputs, typically to train a rival or smaller model, using compromised credentials. Raad said attackers had been targeting the company's systems for at least 48 hours using AI agents. BleepingComputer gives the exposure window as starting 2026-10-17 00:30 UTC. The entry vector, dwell time, absolute number of affected accounts and technical evidence for the distillation claim have not been published. As of the sources reviewed, no post-mortem, CVE, malware family, network IOCs or threat-actor attribution was available.
Impact reported by users on X and Reddit: unauthorized charges of $281 (OpenAI) plus $168 (Anthropic) for one user, about $1,700 total for another, $400+ on Anthropic and about EUR 200 on Google for others. Some Google Cloud projects were suspended for 'abusive activity' consistent with hijacked resources. Anthropic reportedly proactively revoked keys it believed were compromised. OpenCode emailed affected users (subject reportedly 'Action Required: Potential provider key breach') telling them to revoke and replace keys with each provider. Sources disagree on the notification date: The Hacker News says 2026-10-17, BleepingComputer says 2026-10-19. OpenCode offered potential reimbursement and is coordinating with Google, Anthropic and OpenAI.
During incident response, Raad said frontier AI models initially assisted and then began refusing, which frustrated investigation. OpenCode then gained access to OpenAI's 'Daybreak blue' defender cybersecurity tier. Severity is an analyst assessment (HIGH): confirmed financial abuse of stolen third-party credentials, with a limited blast radius.
MITRE ATT&CK techniques used in TL-2026-3942
Initial Access
Collection
Impact
T1496.004 Cloud Service Hijacking; T1657 Financial Theft
Credential Access
Affected products and versions in OpenCode Console breach exposes linked AI-provider API keys
- OpenCode — OpenCode Console (hosted workspace service, legacy system)
Vulnerable versions: Console accounts with linked external AI provider keys (about 1.4% of users) - Anthropic / OpenAI / Google Cloud — API keys linked to OpenCode Console
Vulnerable versions: Keys saved in OpenCode Console on or before 2026-10-17
Fixed in: Keys revoked and re-issued by the user
Remediation for OpenCode Console breach exposes linked AI-provider API keys
Immediate actions
- If you received the OpenCode notification email, revoke the OpenAI, Anthropic and Google API keys linked in OpenCode Console at each provider and issue new ones
- Update every application and CI secret that used the revoked keys
- Review provider usage and billing logs from 2026-10-16 onward for unexpected spikes, models or regions
- File billing disputes with providers for documented unauthorized charges
- Check Google Cloud projects for suspension notices or abusive-activity warnings
Workarounds
- Use the OpenCode CLI or desktop app with locally stored keys, which OpenCode states were not affected
- Unlink external providers from OpenCode Console until OpenCode publishes a post-mortem
Longer-term hardening
- Set per-key and per-project spend caps and usage alerts at each AI provider
- Prefer scoped, least-privilege, short-lived provider keys; avoid storing long-lived provider keys in third-party hosted consoles
- Rotate AI-provider keys on a schedule and monitor for anomalous inference volume
- Decommission legacy systems promptly and keep them out of scope for credential storage
Weaknesses (CWE) in OpenCode Console breach exposes linked AI-provider API keys
Timeline of OpenCode Console breach exposes linked AI-provider API keys
- An intruder reaches a legacy OpenCode Console system on the night of 2026-10-16, per The Hacker News; the exact entry vector is undisclosed.
- Affected users report unauthorized charges on linked OpenAI, Anthropic and Google keys, from $168-$281 per provider up to about $1,700 in total. Anthropic reportedly revokes keys it believes were compromised.
- OpenCode publicly discloses the incident. It says about 1.4% of Console users with linked external provider keys are affected and tells them to revoke and replace the keys. The Hacker News reports an email titled 'Action Required: Potential provider key breach' on this date.
- Exposure window begins at 00:30 UTC, per BleepingComputer; AI-agent-driven distillation activity against OpenCode systems follows.
- Attackers continue targeting OpenCode systems. Co-founder Dax Raad says the attacks have run for at least 48 hours and that frontier AI models began refusing to assist the incident-response investigation.
- BleepingComputer publishes 'OpenCode hack exposes API keys amid AI distillation attacks'. Some Google Cloud projects are reported suspended for abusive activity.
- BleepingComputer reports OpenCode notified all affected users by email that morning ('If you did not get an email, you were not impacted'). OpenCode says it stabilized using OpenAI's Daybreak AI cybersecurity model and offers potential reimbursement while coordinating with Google, Anthropic and OpenAI.
Sources cited for OpenCode Console breach exposes linked AI-provider API keys
- OpenCode hack exposes API keys amid AI distillation attacks
- OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys
- Getting Blocked By AI Agent Cyber Safeguards While Fighting Malicious AI Agents, Says OpenCode Co-Founder Dax Raad After Hack
- OpenCode Console Breach: Rotate Your API Keys Now (1.4%)
- OpenCode Console breach exposed users' AI provider API keys
- OpenCode Breach May Have Exposed OpenAI, Anthropic and Google API Keys, Users Report Unexpected Charges
- OpenCode Breach: Provider API Keys Exposed, What to Do
Detection coverage for TL-2026-3942
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3942 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.