# OpenCode Console breach exposes linked AI-provider API keys amid large-scale distillation attack

> An intruder reached a legacy OpenCode Console system on the night of 2026-10-16, potentially exposing third-party AI-provider API keys (Anthropic, OpenAI, Google) saved by about 1.4% of Console users. OpenCode attributes the activity to a large-scale distillation attack run with AI agents; affected users reported unauthorized charges from hundreds of dollars to over $1,700.

- **Published:** 2026-10-20T08:16:53Z
- **Last reviewed:** 2026-10-20T08:16:53Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3942
- **ID:** TL-2026-3942
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)

## Description

OpenCode, an open-source AI coding agent, disclosed a security incident affecting its hosted OpenCode Console, not the OpenCode CLI or desktop applications. Co-founder Dax Raad stated that keys stored locally by the CLI and desktop apps (in local SQLite databases) 'never come to us' and were not affected. According to The Hacker News, an intruder accessed a legacy system on the night of 2026-10-16. Secondary reporting (OrcaRouter, unverified) describes it as a legacy Console system being decommissioned. Third-party AI-provider API keys that users had saved in the Console (OpenAI, Anthropic, Google Cloud) may have been exposed. Only Console users with an external provider linked were affected, about 1.4% of Console users.

OpenCode characterized the activity as a 'large-scale distillation attack': harvesting large volumes of model outputs, typically to train a rival or smaller model, using compromised credentials. Raad said attackers had been targeting the company's systems for at least 48 hours using AI agents. BleepingComputer gives the exposure window as starting 2026-10-17 00:30 UTC. The entry vector, dwell time, absolute number of affected accounts and technical evidence for the distillation claim have not been published. As of the sources reviewed, no post-mortem, CVE, malware family, network IOCs or threat-actor attribution was available.

Impact reported by users on X and Reddit: unauthorized charges of $281 (OpenAI) plus $168 (Anthropic) for one user, about $1,700 total for another, $400+ on Anthropic and about EUR 200 on Google for others. Some Google Cloud projects were suspended for 'abusive activity' consistent with hijacked resources. Anthropic reportedly proactively revoked keys it believed were compromised. OpenCode emailed affected users (subject reportedly 'Action Required: Potential provider key breach') telling them to revoke and replace keys with each provider. Sources disagree on the notification date: The Hacker News says 2026-10-17, BleepingComputer says 2026-10-19. OpenCode offered potential reimbursement and is coordinating with Google, Anthropic and OpenAI.

During incident response, Raad said frontier AI models initially assisted and then began refusing, which frustrated investigation. OpenCode then gained access to OpenAI's 'Daybreak blue' defender cybersecurity tier. Severity is an analyst assessment (HIGH): confirmed financial abuse of stolen third-party credentials, with a limited blast radius.

## MITRE ATT&CK

- T1552 Unsecured Credentials
- T1078.004 Cloud Accounts
- T1119 Automated Collection
- T1496.004 Cloud Service Hijacking
- T1657 Financial Theft

## Sources

- [OpenCode hack exposes API keys amid AI distillation attacks](https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/)
- [OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys](https://thehackernews.com/2026/10/opencode-console-breach-may-have.html)
- [Getting Blocked By AI Agent Cyber Safeguards While Fighting Malicious AI Agents, Says OpenCode Co-Founder Dax Raad After Hack](https://officechai.com/ai/getting-blocked-by-ai-agent-cyber-safeguards-while-fighting-malicious-ai-agents-says-opencode-co-founder-dax-raad-after-hack/)
- [OpenCode Console Breach: Rotate Your API Keys Now (1.4%)](https://www.explainx.ai/blog/opencode-console-breach-stored-api-keys-distillation-attack-what-to-do-2026)
- [OpenCode Console breach exposed users' AI provider API keys](https://www.orcarouter.ai/blog/2026-10-17-opencode-console-breach-api-keys)
- [OpenCode Breach May Have Exposed OpenAI, Anthropic and Google API Keys, Users Report Unexpected Charges](https://www.ibtimes.sg/opencode-breach-may-have-exposed-openai-anthropic-google-api-keys-users-report-unexpected-charges-95292)
- [OpenCode Breach: Provider API Keys Exposed, What to Do](https://cellcog.ai/blog/opencode-breach-api-keys/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3942