OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys
A breach at OpenCode's legacy system, specifically affecting its Console service, may have exposed third-party AI provider keys for OpenAI, Anthropic, and Google, impacting 1.4% of Console users.
Intelligence analysis by Gemini 2.5 Flash
OpenCode, an AI provider, reported that an intruder accessed a legacy system on October 16, potentially compromising API keys stored in its optional hosted service, OpenCode Console. These keys, used by team members to access AI models without direct exposure, are bearer credentials, meaning anyone with a copy can incur billable requests on the owner's account until revoked.
Imagine you have a special secret key that lets you use a super smart robot helper, and you keep that key in a special locker at a company called OpenCode. Someone broke into that locker and might have copied your key. Now, they could use your key to make the robot do things, and you'd get the bill, even if you didn't ask for it. OpenCode told people to quickly change their keys, like changing the lock on your house, so the bad guys can't use them anymore.
Analysis
The recent security incident at OpenCode, specifically targeting its Console service, reveals significant vulnerabilities in how third-party AI provider keys are managed and secured. The breach, which occurred on October 16, involved an intruder accessing a legacy system, potentially exposing sensitive API keys for major AI platforms like OpenAI, Anthropic, and Google. This event underscores the inherent risks of centralized key storage, even within an 'optional hosted service' designed to abstract key management from end-users.
OpenCode Console
OpenCode Console functions as an intermediary, allowing users to store their AI provider keys in a hosted environment, enabling team members to utilize AI models without directly handling the credentials. This design, while convenient, creates a single point of failure, as demonstrated by the breach. The company explicitly stated that the breach affected "the OpenCode Console, not OpenCode itself," and that keys stored via command-line or desktop apps were not compromised, emphasizing the isolated nature of the vulnerability within the Console's architecture. However, for the 1.4% of Console users with linked external providers, this distinction offers little comfort, as their keys became potential targets.
Distillation Attack
The incident has been linked by OpenCode to a "large-scale distillation attack," a term used by AI model providers for campaigns that extract vast amounts of model responses to train rival AI models. Anthropic previously noted that such campaigns often leverage networks of fake accounts, stolen credit cards, login credentials, and harvested API keys. This connection suggests that the breach at OpenCode Console might not have been a random act but a targeted effort to acquire resources for AI model training or other illicit activities. The ongoing nature of the attacks, with intruders reportedly attempting to access OpenCode's systems for 48 hours post-breach, further indicates a sophisticated and persistent threat actor.
Provider Keys
The exposed provider keys are described as bearer credentials, meaning that anyone possessing a copy can execute billable requests against the owner's account until the key is revoked. This characteristic makes the breach particularly damaging, as evidenced by user reports of unauthorized usage totaling hundreds or even thousands of dollars on their OpenAI, Anthropic, and Google accounts. OpenCode's guidance to revoke and replace keys, update applications, and review billing is crucial but places the burden of mitigation squarely on the affected users. The inability of Console's budget limits to cap unauthorized usage highlights a critical design flaw: the system only monitors requests passing through its own gateway, leaving direct use of stolen keys unchecked and unmonitored.
Key points
- An intruder accessed a legacy system at OpenCode on October 16, potentially exposing third-party AI provider keys stored in OpenCode Console.
- The breach affects 1.4% of Console users who had linked external AI providers like OpenAI, Anthropic, and Google.
- Exposed keys are bearer credentials, allowing unauthorized parties to incur billable requests on user accounts until revoked.
- Users have been advised to revoke their old keys, create new ones, update all applications, and review billing for unauthorized usage.
- The incident is linked to a "large-scale distillation attack" and attackers were still attempting to breach OpenCode's systems days after the initial incident.
OpenCode's immediate notification to affected users and its collaboration with Anthropic, OpenAI, and Google demonstrate a proactive response to mitigate the breach's impact. The company's statement that ongoing attacks are leading to systems being "hardened" suggests that this incident could ultimately result in stronger security measures and improved resilience against future threats.
The reported financial losses by users, some exceeding $1,700, highlight the immediate and tangible consequences of the breach. The ongoing nature of the attacks and the lack of detailed information regarding the initial compromise or the total number of affected keys suggest a persistent threat and potential for wider, unquantified damage and continued unauthorized usage.
