OpenCode breach exposed provider API keys for 1.4% of Console users

OpenCode disclosed a distillation attack in which attackers gained API key access through a legacy system, leading to unauthorized queries against high-end AI models (news.leodex.io). The company says stored external provider API keys belonging to about 1.4% of Console users were exposed, with reports dating the exposure to October 17, 2026 (blockonomi.com; news.leodex.io). Affected credentials spanned Anthropic, OpenAI, and Google integrations (devx.com; thecooldown.com).

The structural finding matters more than the percentage: the Console held third-party provider keys in user workspaces in a form the incident could reach, making those credentials part of the Console's own custody boundary (vectorwire.ai). The access window's end and whether any exposed key was used remain unstated.

Mechanics: legacy system, distillation label

OpenCode attributes the breach to a legacy system vulnerability and characterizes it as a large-scale distillation attack, in which attackers ran high-volume queries against frontier models using stolen keys (vectorwire.ai; news.leodex.io). The supplied accounts do not describe the failed validation, the prerequisites, or how access was obtained, so the causal chain from entry to key exposure cannot be reconstructed (vectorwire.ai).

Some affected users reported account balance drains reaching hundreds of dollars, and OpenAI restored service for affected API customers and refunded credits consumed in the attack (vectorwire.ai; ai-primer.com). That distinguishes reported misuse for some accounts from whether every exposed key was used.

One account adds that models began refusing investigative work mid-incident and that "Daybreak" access required approval for reduced refusals on named models (ai-primer.com). The breach connection is not explained in the supplied material, so it stays unlinked. The reference material also names a product, "daybreak_blue," without explaining its relation to the Console (ai-primer.com).

Impact: a percentage whose denominator matters

The 1.4% figure is attributed to OpenCode and measured against Console users, not the subset who stored provider keys, so the exposure rate among key-holders is unstated (blockonomi.com). These are exposure figures, not confirmed-loss figures.

• Oct 17, 2026: reported start of the exposure window; breach reporting begins (blockonomi.com).
• Oct 18–19, 2026: coverage describes ongoing attack activity, the affected Console, and third-party provider keys (vectorwire.ai).
• Oct 25–26, 2026: later reports describe refunds, rotation advice, and an ongoing investigation (byteiota.com; ai-primer.com).

Response and the observable test

Disabling an API key is a containment action, and two providers reportedly took it: Anthropic and Google disabled affected keys (devx.com; thecooldown.com). The supplied accounts do not establish that either provider detected misuse; disabling can follow notification alone. OpenCode is reported to be collaborating with Anthropic, OpenAI, and Google on remediation (news.leodex.io), and OpenAI reportedly restored service and refunded consumed credits (ai-primer.com).

Refunds and rotation guidance are reported responses, not evidence that no key was misused; missing confirmation of misuse is not confirmation of no misuse. Rotation shifts the re-keying step onto users, whose individual rotation histories are not established by the timing of the disclosure.

Provider-side abuse telemetry, Console access logs, or provider billing data confirming use of an exposed credential would move this from exposure toward demonstrated compromise. Whether that materializes is not established as of October 27.

Explore more coverage on BeansSearch this story across publishers→