Heads up if you use OpenCode’s hosted Console. OpenCode says an intruder got into a legacy system on the night of October 16, and the AI provider keys some users saved in Console may have been exposed.
Who’s affected
- About 1.4% of Console users, the ones who linked their own OpenAI, Anthropic or Google keys. They got an email on October 17 titled “Action Required: Potential provider key breach.”
- The OpenCode CLI and desktop app keep keys locally, and co-founder Dax Raad said those keys “never come to us.”
- OpenCode tied it to “a large-scale distillation attack” and said it’s working with Anthropic, OpenAI and Google.
- Some users report surprise charges, from a few hundred dollars up to $1,700, though OpenCode itself has only said keys “may have been exposed.”
What to do
- Revoke the key in the provider’s own dashboard. Deleting it from Console does not revoke it.
- Create a new key and update every app and script that used the old one.
- Check usage and billing back to at least October 16.
- Set spend limits or alerts, and give each tool its own key so a leak does less damage and is easier to trace.
My take
An API key is cash. Anyone holding a copy can run up your bill until you revoke it. Every hosted tool you paste a key into is one more place it can leak, so keep keys local when you can, one key per tool, and spend caps on everything.
Have a blessed day! And Happy Hacking!
