OpenCode Console Breach Exposes User API Keys

Executive Summary

On October 17, 2026, OpenCode, a popular open-source AI coding agent from Anomaly Innovations, revealed a security breach impacting its Console product. An attacker gained unauthorized access to a legacy system, exposing API keys that users had stored for third-party AI services, including OpenAI, Anthropic, and Google. The breach affected approximately 1.4% of Console users, some of whom subsequently reported large, fraudulent charges on their AI provider accounts. OpenCode has termed this a "large scale distillation attack" and is working with the AI providers to address the incident. All affected users have been notified and urged to rotate their exposed API keys immediately.

Threat Overview

The breach stemmed from an attacker compromising a legacy OpenCode system that was slated for decommissioning. This system contained sensitive user data, including API keys for powerful AI models that users had linked to their OpenCode Console workspace. The "bring-your-own-key" (BYOK) model, while popular for its flexibility, concentrated significant risk in this single point of failure.

Upon gaining access to these keys, the attackers immediately began using them to make a high volume of requests to the AI service providers. This activity, dubbed a "distillation attack," involves using powerful, expensive models (like GPT-4 or Claude 3) to generate vast amounts of high-quality data. This data is then likely used to train a smaller, less capable, and cheaper-to-run model, effectively "distilling" the knowledge of the larger model at the victims' expense.

Technical Analysis

The attack highlights a critical vulnerability in the ecosystem of AI-powered developer tools. The primary TTPs are:

1. Exploit Public-Facing Application (T1190): The attacker gained initial access by exploiting an unspecified vulnerability in a legacy OpenCode system.
2. Steal Application Access Token (T1528): The core of the attack was the theft of API keys, which function as access tokens for the AI services. These keys were likely stored insecurely on the compromised legacy system.
3. Resource Hijacking (T1496): The attackers used the stolen keys to consume the victims' AI service credits for their own purposes (the distillation attack), leading to direct financial loss for the legitimate key owners.

This incident demonstrates that in the AI era, credentials are not just for data access but also for accessing expensive computational resources, creating a new motive for credential theft.

Impact Assessment

The immediate impact on the 1.4% of affected users was financial. Reports on social media showed users facing fraudulent bills ranging from hundreds to over $1,700. This direct financial loss is a tangible consequence of the breach. Beyond the financial cost, the incident damages trust in OpenCode and the broader ecosystem of AI developer tools that rely on the BYOK model. It forces a re-evaluation of the security responsibilities in such systems, where a vulnerability in one tool can have direct financial repercussions across multiple other services. For the AI providers (OpenAI, Anthropic, Google), this incident creates customer support challenges and potential revenue loss from chargebacks.

IOCs — Directly from Articles

No specific IOCs such as IP addresses, domains, or file hashes were mentioned in the source articles.

Cyber Observables — Hunting Hints

Security teams and individual developers may want to hunt for the following patterns to detect related activity:

• API Usage Monitoring: Look for sudden, dramatic spikes in API usage or cost for services like OpenAI, Anthropic, or Google AI Platform. Baselines should be established for normal usage.
• Geographic Anomalies: Monitor API key usage from unexpected or new geographic locations.
• Model Usage Anomalies: An alert could be triggered if an API key normally used for gpt-3.5-turbo suddenly starts making thousands of calls to the more expensive gpt-4o.
• Time-of-Day Anomalies: API usage at odd hours (e.g., 3 AM for a developer who only works 9-5) could indicate a compromise.

Detection & Response

1. Implement Usage Alerts: Configure billing and usage alerts on all cloud and AI service provider dashboards. Set thresholds that are slightly above normal usage to get early warnings of anomalous activity.
2. Regular Key Audits: Periodically review all active API keys. Identify their purpose, owner, and last-used date. Revoke any keys that are no longer needed.
3. Centralized Monitoring: Ingest API usage logs into a central SIEM or logging platform. This allows for the correlation of usage patterns across different services and the creation of more sophisticated detection rules for Resource Access Pattern Analysis (D3-RAPA).
4. Response Plan: If a key compromise is suspected, the immediate response should be to revoke the key in the provider's dashboard. Subsequently, analyze usage logs to determine the extent of the abuse and report the fraudulent activity to the provider.

Mitigation

1. Key Rotation: Implement a strict policy for rotating API keys regularly (e.g., every 90 days). This limits the window of opportunity for an attacker who steals a key. This is a form of Credential Hardening.
2. Use Scoped Keys: Whenever possible, create API keys with the minimum required permissions. If a key only needs to read data, do not grant it write permissions. If it only needs to access one model, restrict it to that model.
3. Secure Storage: Never hardcode API keys in source code. Use secure secret management solutions like HashiCorp Vault, AWS Secrets Manager, or GitHub Actions secrets. For local development, use environment variables or a local secrets manager.
4. IP Allowlisting: If the AI provider supports it, restrict API key usage to a specific set of known IP addresses (e.g., your office or production server IPs). This is a powerful mitigating control.