The call
OpenCode confirmed the breach on X at 18:08 UTC on 17 October (vendor, OpenCode on X), about two and a half hours after a researcher posted the customer email (Matt Johansen on X, 15:30 UTC). Coverage: DEV Community, TokenPost, Cyera, and HuggingNews (independent). It was the top story on Hacker News on 17 October with 696 points (independent, Zeli digest).
What it is, and what it is not
What it is. Console is OpenCode’s optional cloud gateway. A team links provider accounts it already pays for, and members use the models without seeing the key (vendor, via DEV Community). OpenCode says an unauthorised party reached “a legacy system that we were in the process of decommissioning”, that third-party provider keys saved in a workspace “may have been exposed”, and that 1.4% of Console users were affected and emailed (vendor, via DEV Community and Cyera). It is working with Anthropic, OpenAI, and Google, and says the incident is ongoing (vendor). Some affected users report bills in the hundreds of dollars (independent, Crypto Briefing).
What it is not. It is not a breach of OpenAI, Anthropic, or Google. Nothing published says keys used only with OpenCode’s local CLI were exposed (independent, Cyera). And “distillation attack” is OpenCode’s label, not an explanation: it has not said how the attacker got in, how the keys were stored, or how long access lasted. The useful reading is simpler. A key in someone else’s database is a key you no longer control.
The number nobody is quoting
Coverage leads with 1.4%. That is a share of Console users, and OpenCode has not said how many accounts it is (independent, DEV Community). The number that matters to a key owner is the burn rate, and the calendar.
One developer, Max Weinbach, says his OpenAI account logged about 35 million tokens across 8,966 requests in the day before he checked (independent, TokenPost). One account, self-reported, not an average.
| Measure | Figure | Label |
|---|---|---|
| Tokens per request | 35,000,000 ÷ 8,966 = 3,904 | our maths |
| Requests an hour | 8,966 ÷ 24 = 374 | our maths |
| Requests a minute | 374 ÷ 60 = 6.2 | our maths |
| Hours from OpenCode’s confirmation (Sat 18:08 UTC) to Monday 09:00 Eastern (13:00 UTC) | 42.9 | our maths |
| Requests in that gap at the same pace | 374 × 42.9 = 16,014 | our maths |
| Tokens in that gap at the same pace | 35M ÷ 24 × 42.9 = 62.5M | our maths |
A team that leaves this for Monday’s stand-up hands a stolen key almost two more days at that pace. The second number nobody is quoting: Console budgets only cap spend routed through OpenCode, so they do nothing against a stolen key called directly at the provider (independent, Cyera). The only limit that holds is the one set in the provider’s own account.
Missing
What OpenCode has not told its users, as of 18 October:
- How many accounts 1.4% is.
- How the attacker got in, and what the legacy system was.
- How the keys were stored, and whether they were encrypted.
- When access began and when it ended.
- Whether every exposed key was copied, and which were used.
- Whether keys used with the local CLI are affected.
- Who pays for fraudulent usage: the user, OpenCode, or the provider.
- An IP range, user agent, or time window a key owner can search for in provider logs.
Who owns what
Storing the key was OpenCode’s job. Knowing every place your key lives is yours.
The pattern is not OpenCode’s alone. One stored provider key, many users, a platform you did not write. In a Salesforce estate the same key often sits in a Named Credential behind an Apex callout to OpenAI or Anthropic, in a connected model in Einstein Studio, in a middleware or iPaaS connection, and in CI secrets. Each copy is a separate exposure with a separate owner. The fix is the same everywhere: one key per system and environment, a hard spend limit at the provider, and a named owner who can rotate it in an hour.
Commercial decision: an hour of rotation on a Sunday, or an unbounded bill and an unknown data exposure by Monday. Depending on scope, a key can also reach files, stored responses, and fine-tuned models (independent, Cyera). Rotate.
Monday morning
- Step 1. Find who used Console, today. Ask developers whether they received OpenCode’s email, and search corporate cards and expense data for OpenCode charges. Owner: engineering manager.
- Step 2. Rotate at the provider, not in OpenCode. Issue a new key in each provider’s dashboard, reached directly rather than from a link in a breach email, move every consumer to it, then revoke the old one. Confirm the old key now fails. Owner: platform or security lead.
- Step 3. Review usage from 16 October. Look for spikes, unfamiliar models, and off-hours traffic on every provider account that was linked. Owner: FinOps lead.
- Step 4. Set hard spend limits and alerts at the provider. One key per project and environment, scoped as narrowly as the provider allows. Owner: platform lead.
- Step 5. Inventory every stored copy of every AI key. Coding agents, gateways, CI, Salesforce Named Credentials, Einstein Studio connections, and middleware. Name an owner for each. Owner: security lead with the Salesforce admin.
We move this to WATCH when OpenCode publishes the root cause, the access window, and the number of affected accounts. The inventory in Step 5 stays PILOT regardless: the next gateway breach will not come with a weekend warning.
Frequently asked questions
Was OpenAI, Anthropic, or Google breached?
No. OpenCode says an unauthorised party reached a legacy system behind its Console cloud service, where teams store their own provider keys. The providers are helping with remediation. Nothing published says the providers’ own systems were compromised.
I use OpenCode only on my laptop with my own key. Am I affected?
OpenCode says affected users were those with external providers linked to a Console workspace, and that everyone affected was emailed. It has not addressed keys used only with the local CLI. If your key ever sat in a Console workspace, rotate it.
Is deleting the key from OpenCode enough?
No. OpenCode says removing a key from its Console does not invalidate copies already taken. Revoke and reissue the key in the provider’s own dashboard, update every tool and pipeline that uses it, and confirm the old key now fails.
Living page. Last updated 18 Oct 2026. What would change our call: OpenCode publishing the root cause, the access window, and the number of affected accounts.