#opencode

Read Time:3 Minute, 9 Second

OpenCode has disclosed a security incident that may have exposed third-party artificial intelligence provider credentials stored by a small segment of its Console customers. The company said 1.4% of Console users were affected, specifically users who had connected external providers and saved their keys inside impacted workspaces. OpenCode notified the affected group directly on October 17 and said customers who did not receive that notice were outside the identified scope.

The distinction matters: the figure applies to OpenCode Console accounts, not to OpenCode’s entire user population. Even so, an exposed API key can create consequences well beyond the breached platform. Depending on the permissions and provider involved, a valid credential could let an unauthorized party consume paid model services, inspect usage patterns or interact with resources associated with the account.

A legacy system created the exposureAccording to the customer notification, the intruder obtained unauthorized access to an older system that OpenCode was already preparing to retire. Provider credentials held in affected workspaces—including keys for services such as OpenAI and Anthropic—may have been accessible. The disclosure describes a potential exposure; it does not establish that every key in scope was copied or later abused.

Several important details remain unavailable. OpenCode has not explained the initial access method, the duration of the intrusion, the number of credentials involved or the identity of the attacker. It has also not released technical indicators that customers could use to independently connect suspicious provider activity to the incident.

The company linked the breach to a large-scale model-distillation attack and said it was coordinating with Anthropic, OpenAI and Google. Model distillation generally uses responses from one model to help train or improve another. At scale, an unauthorized operator could generate large volumes of responses using improperly obtained access. OpenCode has not said whether the credentials at issue were actually used for those requests, so the stated connection should not be read as a complete attack narrative.

Key rotation must cover every dependent systemRecipients of the warning should revoke affected credentials and issue replacements from the relevant provider dashboards. Rotation is only effective when the old secret is invalidated and the replacement is propagated to every legitimate service that needs it. That may include developer laptops, CI/CD pipelines, serverless functions, secret managers and production applications.

Revoke the exposed key rather than merely creating an additional credential.

Review model usage, audit logs and billing records for unfamiliar spikes or requests.

Update applications with the replacement key through an approved secrets-management process.

Search code repositories, logs and configuration stores for other copies of the old secret.

Restrict the new credential’s permissions, spending limits and network reach where supported.

Billing review is especially useful because abusive automated traffic may leave a financial trail even when application logs are limited. Teams should record the time of revocation and compare provider events before and after it. Unexpected activity should be preserved for investigation and reported to the provider.

A reminder to minimize stored secretsThe incident highlights the concentration risk created when a development platform retains keys for multiple external services. Organizations should inventory which platforms store provider credentials, determine whether long-lived keys are necessary, and prefer short-lived or narrowly scoped access methods when available. Central secret storage, automated rotation and alerts for anomalous consumption can reduce both exposure and response time.

OpenCode said the incident was ongoing when it published its statement and that it could not yet provide fuller details. A subsequent technical report will be important for clarifying how the legacy environment was reached, what records were accessed and whether the reported distillation activity used customer credentials. Until then, notified users should treat rotation and usage review as urgent containment steps rather than wait for proof of misuse.