OpenCode Console breach triggers unauthorized AI API charges, report says

OpenCode says a security breach affected 1.4% of users of its hosted Console, and TechCrunch reports that developers saw unauthorized charges on their AI provider accounts. The company’s public statement identifies the affected group as a subset of Console users who had external providers linked, and says it notified them by email.

The distinction between the hosted service and the coding agent matters. TechCrunch attributes to co-founder Dax Raad the statement that the exposed keys were confined to Console workspaces and that the open-source application and command-line tool were not affected. That is the company’s account of scope, not a claim that every third-party integration has been independently audited.

Providers respond to exposed keys

In its October 19 report, TechCrunch says Anthropic and Google blocked keys they believed were exposed. It reports that OpenAI worked with OpenCode to restore access and refund its API customers for credits used in the attack, and attributes to OpenCode a statement that unauthorized-charge refunds were underway.

The report says affected users were told to revoke and replace their keys directly with each provider. A developer’s Console notification and provider account records are the relevant places to establish individual impact; the company-wide percentage does not identify which particular account was affected.

The distillation explanation is disputed

OpenCode calls the breach a large-scale distillation attack. TechCrunch notes objections to that framing: stolen keys and unauthorized model usage do not, by themselves, establish that the outputs were used to train another model.

The reviewed report says OpenCode has not disclosed the initial access method, how the keys were stored or the full extent of misuse. Those remain open questions. The supported development is the reported Console breach, its user-account consequences and the remediation described by the company and providers, rather than a proven account of the attackers’ identity or purpose.