What happened
OpenCode makes an open-source coding agent. It also runs an optional hosted service called Console, where a team can save its own OpenAI, Anthropic, or Google key so members can use those models without seeing the key. According to The Hacker News, an intruder reached a legacy system at OpenCode on the night of October 16. OpenCode emailed affected customers on the morning of October 17 under the subject line "Action Required: Potential provider key breach." The email said provider keys saved in a workspace "may have been exposed." OpenCode said the affected group was 1.4% of Console users, a subset of those with an outside provider linked. It said anyone who did not receive an email was not affected. It called the incident ongoing and said it was working with Anthropic, OpenAI, and Google. It also linked the breach to what it called "a large scale distillation attack." It has not explained that link. Affected users were told to revoke and replace the keys in each provider's dashboard, update any application that used them, and review recent usage. Co-founder Dax Raad wrote on X that the breach involved the Console, not the OpenCode coding tool itself, and that keys stored locally in the tool "never come to us," as quoted by The Hacker News. Some users say they were charged for usage they did not run. Notebookcheck cites Reddit reports of $400 on an Anthropic account and about 200 euros of Google usage. The Hacker News cites further user claims on X. These are the users' own accounts, and OpenCode has not confirmed that any key was copied or used. OpenCode has also not said how the attacker got in, how long access lasted, or how many users 1.4% represents.
Why it matters for business owners
You may never use OpenCode. The pattern applies to any tool or person that holds a copy of your AI key. A provider key is what lets software call a paid AI model on your account. As The Hacker News describes it, it is a bearer credential: whoever holds a copy can run billable requests until the provider revokes it. There is no second step that proves the caller is you. That makes a stored key different from a stored document. A leaked document is a privacy problem. A leaked key is also a billing problem, and it can be used while you sleep. Keys also spread. A developer pastes one into a tool, a contractor saves one in a script, a gateway stores one so a team can share it. Each copy is another place the key can be taken from, and many owners cannot list those places.
What owners should not misunderstand
Do not assume the model company was breached. In this case the intruder reached OpenCode's system, not OpenAI's or Anthropic's. The weak point was a middleman that held the keys. Do not assume deleting a key from a tool protects you. The Hacker News notes that deleting a key from Console does not revoke it. Only the provider can do that. Do not assume a budget inside a tool caps the damage. The same report says a Console budget cannot limit use of a stolen key, because Console only sees requests that pass through its own gateway. A limit set at the provider applies to every request on that account. Do not treat the user loss reports as established facts or as typical amounts. They are unverified accounts from individuals, and OpenCode's own wording is "may have been exposed." And do not conclude that hosted gateways are unsafe and local tools are safe. OpenCode says locally stored keys were not part of this incident, but local files can leak too. The question is who holds a copy of the key and what that copy can do.
The operational lesson
An AI key is a company credential and should be managed like one. That means three things. First, you can name every place a key lives. Second, each tool or person has its own key, so one can be shut off without stopping everything else. Third, the provider enforces a spending limit, so a copied key has a ceiling. Most small and mid-size businesses have none of these. Keys sit in a shared document, a developer's laptop, or a tool a former employee set up. Nobody notices until the bill arrives or the provider sends an alert. The cost of fixing this is small compared with the cost of finding out the hard way. It is mostly a few hours of inventory and a few settings in each provider's dashboard.
What a serious business should do next
Make a list of every AI provider account the business pays for: OpenAI, Anthropic, Google, and any others. Note who owns each account and who can create keys. For each account, list the keys and where each one is used. If a key has no known owner or purpose, replace it and see what breaks. That tells you what depended on it. Give each tool or workflow its own key, and name it clearly. A leaked key then tells you where to look, and replacing it does not take down unrelated work. Set a spend limit and an alert at the provider, not only in a tool. Check how each provider enforces limits, since an alert on its own does not stop traffic. Write down what you would do if a key leaked: who revokes it at the provider, who updates the tools that used it, and who checks usage for requests nobody made. Go to the provider's dashboard directly, not through a link in a breach email, since notices like these are common phishing bait. If you or your team used OpenCode Console and saved a provider key there, treat that key as exposed, even if you did not get an email. Replacing it costs little. Ask vendors that store your keys how they are protected, who can see them, and what happens to old systems. This incident started in a system the company was retiring. Check current provider and vendor pages before acting. Details here are early and OpenCode says the incident is ongoing.
The Atlacis view
Atlacis helps owners slow down before an AI decision, map the workflow, and see what each tool actually touches. Keys and logins are part of that map. A tool that saves one is a dependency with a security cost. If you are not sure where your AI keys live or who can create new ones, that is worth mapping before an incident does it for you.
The short version
- OpenCode said on October 17, 2026 that a breach of a legacy system may have exposed AI provider keys saved by 1.4% of its Console users.
- A provider key is a bearer credential. Whoever holds a copy can run billable requests until the provider revokes it.
- Deleting a key from a tool does not revoke it, and a budget inside a tool does not cap use of a stolen key. Revoke at the provider and set limits there.
- User reports of unauthorized charges are unverified. OpenCode says keys "may have been exposed" and has not explained how the intruder got in.
- List where every AI key lives, give each tool its own key, and set a spend limit at the provider.
Where ATLACIS can help
Sources
- The Hacker News: OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys (October 19, 2026)
- Notebookcheck: OpenCode hacked, users urged to revoke their API keys (October 17, updated October 18, 2026)
- Cybersecurity News: OpenCode Security Breach Exposes Third-Party API Keys (October 19, 2026)