The breach affected the online Console
OpenCode reported that an attack affected an old system connected to OpenCode Console, the online service where some users stored the API keys used to access AI model providers. The company said that 1.4% of Console users were affected and that it had notified them by email. The figure concerns the online platform, not necessarily all users of the application.
According to TechCrunch, developers began reporting spending notifications and charges they did not recognize at services such as OpenAI, Anthropic and Google. Some users reported amounts in the hundreds of dollars, with reports exceeding $1,000. Reports on social media do not constitute a verified count of the overall impact, but they show how an exposed credential can quickly turn into a financial loss.
Keys are credentials, not mere settings
An API key authorizes requests to a service and can be linked to an account with billing. If someone obtains one, they can generate paid calls until the key is revoked or reaches set limits. Anthropic and Google reportedly blocked keys believed to be exposed; OpenAI said it had worked with OpenCode to restore access and refund credits used in the attack. OpenCode said refunds were in progress.
Cofounder Dax Raad clarified that the open-source app and command-line interface were not involved: the problem concerned the Console, where users could enter keys in workspaces. This distinction is important for those who need to understand whether they are exposed: they must check which product and which authentication method were used, not just the OpenCode name.
The cause of the incident was still unclear
OpenCode described the episode as a large-scale distillation attack. Distillation is a technique in which a smaller model learns from responses generated by another model. TechCrunch reports that some observers disputed this explanation, noting that the use of the keys to distill capabilities had not been publicly demonstrated. The company had not yet explained in detail how the attackers had entered the system or how many keys had actually been used.
For affected users, the priority is to revoke the exposed credentials at each provider and generate new ones, as well as check invoices, limits and logs. For platforms, the lesson is to treat keys as high-value secrets: store them with limited access, avoid displaying them in logs and offer rapid revocation and spending thresholds.
The incident also highlights a tension in AI security systems: models can help investigate malicious code, but filters designed to prevent offensive assistance can also block defensive activities. This difficulty, reported in the context of the attack, does not change the need to verify the specific technical causes before drawing conclusions about the use of models.
