OpenCode is an open-source AI coding agent, widely known among developers as an alternative to Claude Code and Cursor. The company announced that on Saturday, October 17, the legacy system of its online platform, OpenCode Console, was attacked overnight — the attack took place during the night leading into that day, and the announcement was made the same day. The attack affected 1.4% of the platform's users — their third-party API keys were exposed. Detailed information about the incident spread widely on October 19 through an article published by TechCrunch.
How the Incident Happened
In a statement on X, the company described the incident as a security breach tied to a large-scale distillation attack, using exactly that term in its official statement. All affected users were notified by email; the company added that anyone who did not receive an email was not affected by the attack.
"Last night there was a security breach tied to a large-scale distillation attack; it affected 1.4% of OpenCode Console users. We notified all of them by email this morning."
— from OpenCode's statement on X (TechCrunch quote)
A distillation attack is a method of training another model by collecting model outputs at scale; the company stated the attack was mounted precisely for that purpose. The notification logic was simple: a user who received the email is on the affected list, and one who did not is considered safe.
Which Keys Were Exposed
The exposed data was third-party API keys that users had stored in OpenCode Console workspaces. An API key is a secret string granting access to a provider's services; if it falls into the wrong hands, paid requests can be sent in the account owner's name. These keys provide access to services of external AI providers such as OpenAI, Anthropic, and Google. According to company cofounder Dax Raad, the open-source app and command-line tool were not affected by the attack — local keys remained on users' own devices and could not be accessed from outside.
The damage was thus confined to the online platform: users who did not store keys in Console saw no direct impact from the attack. But for those whose keys were exposed, the risk is serious — unauthorized parties used these keys to run up large charges on provider accounts.
Unauthorized Charges and the Providers' Response
Developers began reporting unauthorized charges on their accounts: some accounts showed hundreds of dollars spent, and some more than $1,000. These figures show that the attackers actively exploited the exposed keys — the charges were unrelated to the key owners' own activity.
Anthropic and Google blocked the API keys believed to be exposed and thus sought to prevent further abuse — no further requests go through a blocked key, which stops additional charges. OpenAI took a different approach: it is working with OpenCode to restore access and refund API customers for credits used in the attack. Blocking keys and issuing refunds were the first practical measures taken after the incident.
48 Hours of Pressure: Even the Defenses Failed
According to Raad, the attackers tried to break into OpenCode's systems continuously for 48 hours — two days of unrelenting pressure kept the team in a constant defensive posture. Complicating matters, the defensive AI agents the team deployed began refusing to analyze malicious code: when the safety filters kicked in, the agents could not continue the analysis.
The company later gained access to OpenAI's Daybreak Blue program. The program allows the use of models with reduced safety constraints for verified defensive security work — meaning analyses for defensive purposes can be performed without restrictions. The company said this access improved its ability to investigate the attack.
The Incident Is Still Ongoing
The company advised affected users to revoke keys through each provider, replace them with new ones, and check their recent usage history. This is presented for now as the only practical measure to prevent the keys from being used again. The incident was still ongoing at the time of the announcement.
OpenCode has not disclosed how the attackers gained access to the legacy system or the full extent of the abuse — both questions remain open. The company has not yet published additional information on these two questions; its own statements and the official OpenCode website are cited as official sources.
