The OpenCode API key breach in October 2026 exposed provider keys saved in OpenCode's legacy Console, not keys held by the local coding agent. OpenCode said 1.4% of Console users were affected, and developer posts describe bills from a few hundred to nearly $5,000.
OpenCode API Key Breach: What Actually Leaked
The OpenCode API key breach exposed provider keys saved in OpenCode Console, a web dashboard for workspaces and bring-your-own-key storage. OpenCode, an open-source terminal coding agent that runs models from several providers, said 1.4% of Console users were affected. Keys used only inside the local app never reach OpenCode's servers, according to co-founder Dax Raad.
The compromised system was a legacy Console already being decommissioned. OpenCode's email to users described unauthorized access to that old system, and it still held live OpenAI, Anthropic Google keys. The current application on a developer's machine was not the entry point.
Hour by Hour: The October 17, 2026 Timeline
The first possible exposure began at 00:30 UTC on October 17, 2026, and key usage appeared about five and a half hours later. That sequence comes from OpenCode's follow-up email and from victim posts collected in the video. All times below are UTC unless marked otherwise.
| Time (UTC, Oct 17 2026) | Event |
|---|---|
| 00:30 | Earliest possible exposure, per OpenCode's follow-up email |
| 06:00 | Usage begins on Colin Parsons' OpenAI key (2 a.m. Eastern) |
| ~13:36 | Parsons posts publicly and tags the OpenCode team |
| ~14:30 | Another developer replies with a $1,700 charge |
| 14:35 | Chris Sinco posts a public revocation warning |
| ~15:30 | Security commentator Matt Johansen posts "Confirmed. OpenCode hacked. Keys stolen." |
| 17:56 | OpenCode confirms the breach and the 1.4% figure |
| 18:08 | OpenCode adds that only users who linked external providers were hit |
| 21:00 | Anthropic Lydia Hallie says affected Claude keys were revoked |
| ~00:00, Oct 18 | Raad says refunds are underway |
Provider alerts often arrived before OpenCode's notice. Sinco said his OpenAI, Anthropic Google spend alerts fired before he went to bed, and only Google suspended his project. Another user reported OpenAI warning him nine hours before OpenCode did.
What Distillation Means and Why OpenCode Used the Term
Distillation is training a smaller model on a larger model's answers, using mass prompts and saved outputs as training data. OpenCode applied the term to this incident, which implies the stolen keys were valued as a supply of model output rather than only as free compute. The company has not published evidence that any stolen tokens trained another model.
Anthropic pursued distillation publicly. In February 2026 it named DeepSeek, Moonshot and MiniMax and said those labs generated more than 16 million conversations with Claude through roughly 24,000 fake accounts, as described in Anthropic account of detecting and preventing distillation attacks. That figure is Anthropic own, not an independent audit.
On October 12, 2026, five days before the breach, Anthropic published a follow-up on strengthening its defenses against distillation attacks. It reported that distillers pulled about 8,800 times more reasoning than on the quietest day before new safeguards, against about 135 times after, which the post describes as roughly 90 to 99% less data. Those are vendor-reported measurements for its own detection system, and Anthropic noted the new rules covered only API accounts created from August 31, 2026 onward.
Why Stolen Developer Keys Became More Valuable
Stolen API keys gained value because account-level defenses made impersonation more reliable than fake signups. Tightened anti-distillation rules pushed demand toward keys tied to real developers, real billing history and older accounts. OpenCode's breach supplied exactly that.
That last log is a hint about who used the keys, not proof. AI researcher Nathan Lambert questioned the label publicly, asking OpenCode to say whether the tokens trained other models. OpenCode has not answered that question in public.
Who Pays: Reported Losses and Refunds
Victims reported losses ranging from a few hundred dollars to nearly $5,000 in a single account, and OpenCode said it was negotiating reimbursement with OpenAI, Anthropic Google. Those dollar amounts come from developers' own public posts and were not audited. No provider has confirmed a refund policy for this incident.
| Victim (as reported) | Reported loss | Detail |
|---|---|---|
| Colin Parsons | $281 OpenAI, $168 Anthropic | Keys used only in OpenCode |
| Anonymous replier | $1,700 | Posted under Parsons' thread |
| Preston Zeller | $1,700 | Key he had forgotten about; spending limit was not active |
| Anonymous developer | $3,000 | Asked how to explain the bill at home |
| Another user | Nearly $5,000 in credits | Balance wiped |
| Max Weinbach | Balance below zero | OpenAI logs showed 35 million tokens and almost 9,000 requests |
Raad replied to individuals, shared his email and wrote that OpenCode would get them refunded. Some users asked whether going viral was required to get help. Google suspended several cloud projects after the spike, which locked some developers out on top of the charges.
What to Check Tonight If You Saved a Key in the Console
Revoke and replace every provider key you saved in OpenCode Console, then confirm your spending limits and alerts are active. OpenCode says users who received no breach email were not affected, but its own advice for those who did was to rotate keys in each provider's dashboard and review recent usage.
1. Open each provider dashboard: OpenAI, Anthropic, Google Cloud.
2. Revoke keys that were saved in OpenCode Console, then create new ones.
3. Update every app, script, CI job and environment variable holding the old key.
4. Check the billing page and confirm the hard spending limit is switched on.
5. Turn on usage alerts and set a threshold you would notice.
6. Delete keys you no longer use.The victim posts support each habit. Parsons noticed quickly because his OpenCode keys were the only ones hit. Sinco learned before sleeping because his alerts fired. Zeller's charge came from a forgotten key, and OpenCode's leak came from a system already being shut down. Anthropic revoked the Claude keys it believed were affected, and Lydia Hallie still advised saving a new key if you had stored one there.
Separate Storage, Local Inference and Compliance
OpenCode runs locally as a terminal agent, but local execution does not make the whole service offline or compliant. The breach involved a hosted Console that stored third-party keys. Anyone claiming OpenCode is fully local, or that this incident proves local tools are safe or unsafe, is stretching the evidence.
Regulated deployments need their own controls: key custody, per-app credentials, audit logs, network restrictions and vendor review. A coding agent's file access and a dashboard's key storage are different surfaces, and the incident touched only the second.
OpenCode API Key Breach FAQ
- Was the OpenCode local app compromised in the breach? No. OpenCode's co-founder said keys used in the local app never reach its servers, and the company attributed the exposure to a legacy Console system. The app on your machine was not the entry point.
- How many users were affected? OpenCode said 1.4% of Console users were impacted. It also said only users who linked external providers such as OpenAI, Anthropic Google could have been hit, and that users without a breach email were not affected.
- Did Anthropic confirm the keys were used for distillation? Anthropic it revoked the Claude keys it believed were affected. OpenCode used the term distillation, but neither company has published evidence that stolen tokens trained another model.
- Will OpenCode or the model providers refund the charges? OpenCode said it was talking to OpenAI, Anthropic Google about reimbursement, and its co-founder said refunds were underway. Individual outcomes reported by victims were not independently confirmed.
- What is the single most useful step after a leak like this? Revoke the exposed key first. One key per application limits the blast radius, and a forgotten key with an inactive spending limit is the worst combination, as the forgotten-key reports in this incident show.
- Does this mean API keys are no longer safe to use with coding agents? Keys remain usable, but they need rotation, per-app scoping and spending limits. The loss came from an old system still holding live keys, not from the practice of using keys.
- Where can I read OpenCode's own statement? OpenCode posted updates on X and emailed affected users. Its Console documentation explains the workspace and bring-your-own-key model that stored the exposed credentials.
- Is this related to the CISA, NSA and FBI advisory? A joint advisory in September 2026 described Chinese firms extracting billions of tokens from American AI models. It is context for the pressure on API access, not a finding about this specific breach.
- What does the Skala blog recommend for tracking incidents like this? Skala blog treats first-party statements and victim reports as different evidence classes. Dev doido and Crazystack typescript covered the incident in developer channels; the Crazystack site is one place to follow related Typescript and developer tooling discussion.
Fork this article
Start a new branch from the same video, shaped your way. You keep the credit; the original keeps the attribution.
A fork in another language is filed as a translation of this article, so the two pages point at each other. You can unlink it later from the editor.
0/240
You are creating
- Format
- For
- Language
- Source
- Your angle
You will be asked to sign in before it is generated.
Buy credits