// AI threat desk · 21 Oct 2026
Home/LEAK · Data Leaks
Data LeaksHighKEYSCVSS 8.8

OpenCode Console breach could expose provider keys

An intruder reached a legacy OpenCode system and may have exposed provider keys saved in Console. OpenCode said the affected group was 1.4% of Console users.

· 3 min read
AI-generated image of security analysts investigating a possible breach involving exposed provider keys.
AI-generated image, not a photo of the event.
Key takeaways
  • An intruder reached a legacy OpenCode system on the night of Oct 16 and may have exposed provider keys saved in Console.
  • OpenCode said the affected group was 1.4% of Console users with an outside provider linked.

OpenCode said an intruder reached a legacy system on the night of Oct 16 and may have exposed third-party AI provider keys saved in OpenCode Console. The email to affected users went out on the morning of Oct 17.

The affected group was 1.4% of Console users who had an outside provider linked. The exposed keys could include credentials for OpenAI, Anthropic and Google. The Hacker News said deleting a key from Console does not revoke it, and a Console budget cannot cap provider use that bypasses the gateway.

Console is OpenCode’s optional hosted service: each workspace saves its own provider key, which Console uses to call the provider without showing the key to team members. OpenCode is a free and open-source artificial intelligence coding agent developed by Anomaly Innovations.

On this page

Console keys could be used outside OpenCode’s controls

Console stores each workspace’s OpenAI, Anthropic or Google key and uses it to call the provider so team members can use the models without seeing the key. The Hacker News said deleting a key from Console does not revoke it, and a Console budget cannot cap provider use that bypasses the gateway.

Notebookcheck said some users reported unexpected provider charges, including $400 on Anthropic and about €200 on Google, with one project suspended for excessive abuse.

Dealroom said Colin Parsons reported $281 in OpenAI usage and $168 in Anthropic usage, while Preston Zeller reported losses of $1,700.

OpenCode said the incident was related to a large-scale distillation attack that impacted 1.4% of Console users. Infosecurity Magazine said OpenCode notified Anthropic, OpenAI and Google to remediate the issue.

OpenCode co-founder Dax Raad said the breach involved OpenCode Console rather than OpenCode itself. He also said attackers had been hitting the company’s systems non-stop for 48 hours.

Earlier OpenCode flaws were not linked to this breach

Safeguard said an earlier OpenCode flaw, CVE-2026-22812, had a CVSS score of 8.8 and involved an unauthenticated HTTP server that let any local process, or any website through permissive CORS, run shell commands. NVD listed the fix in version 1.0.216.

Safeguard said CVE-2026-22813 involved a markdown renderer that put raw HTML from LLM responses into the page, giving script execution on the localhost:4096 origin. The flaw was fixed in version 1.1.10, and neither earlier flaw has been linked to this breach.

Notebookcheck said OpenCode was working with Anthropic, OpenAI and Google to address the incident, which remained ongoing. Anthropic said it revoked affected Claude API keys.

Safeguard said OpenCode had not said when access began, and advised reviewing provider usage from Oct 16 onward and looking further back. OpenCode said users who did not receive its email were not affected.

FAQ

What happened to OpenCode Console users?

An intruder reached a legacy OpenCode system on the night of Oct 16 and may have exposed third-party provider keys saved in Console. OpenCode said the affected group was 1.4% of Console users with an outside provider linked.

Which provider keys may have been exposed?

The keys may include OpenAI, Anthropic and Google credentials saved in OpenCode Console workspaces.

Were OpenCode provider keys used for unexpected charges?

Notebookcheck said some users reported unexpected provider charges, including $400 on Anthropic and about €200 on Google. Dealroom said one user reported $281 in OpenAI usage and $168 in Anthropic usage.

Were earlier OpenCode vulnerabilities linked to this breach?

Safeguard said neither earlier OpenCode flaw has been linked to the breach.

Sources

  1. OpenCode breach drains users' AI keys as platforms holding customer credentials come under attack | Dealroom News, AnthropicPrimary
  2. OpenCode hacked, users urged to revoke their API keys, NotebookcheckPrimary
  3. OpenCode Console Breach: Rotate Your OpenAI, Anthropic and, SafeguardPrimary
  4. OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys, The Hacker News
  5. OpenCode Breach Could Affect OpenAI, Anthropic and Google, Infosecurity Magazine
  6. OpenCode hack exposes API keys amid AI distillation attacks, BleepingComputer
  7. OpenCode, Wikipedia
How we checked this story
ClaimSourceStatus
An intruder reached a legacy OpenCode system on the night of October 16 and may have exposed third-party AI provider keys saved in OpenCode Console.OpenCode, via The Hacker NewsAttributed
OpenCode Console stores each workspace’s OpenAI, Anthropic, or Google key and uses it to call the provider without showing the key to team members.OpenCode, via The Hacker NewsAttributed
OpenCode said the affected group was 1.4% of Console users who had an outside provider linked.OpenCode, via The Hacker NewsAttributed
OpenCode said users who did not receive the email were not affected.OpenCode, via The Hacker NewsAttributed
The breach involved OpenCode Console rather than OpenCode itself, according to co-founder Dax Raad.Dax Raad, via The Hacker NewsAttributed
The Hacker News said deleting a key from Console does not revoke it, and a Console budget cannot cap provider use that bypasses its gateway.The Hacker NewsAttributed
OpenCode’s email said third-party provider keys saved in users’ workspaces may have been exposed.OpenCode, via Infosecurity MagazineAttributed
Infosecurity Magazine said openCode notified Anthropic, OpenAI, and Google to remediate the issue.Infosecurity MagazineAttributed
Notebookcheck said some users reported unexpected provider charges, including $400 on Anthropic and about €200 on Google, with one project suspended for excessive abuse.NotebookcheckAttributed
Notebookcheck said openCode said the incident remained ongoing and that it was working with Anthropic, OpenAI, and Google to address it.NotebookcheckAttributed
Dealroom said colin Parsons reported $281 in OpenAI usage and $168 in Anthropic usage, while Preston Zeller reported losses of $1,700.DealroomAttributed
OpenCode co-founder Dax Raad said attackers had been hitting the company’s systems non-stop for 48 hours.Dax RaadAttributed
Safeguard said openCode users should list every provider key ever saved in a Console workspace, including keys added by other administrators.SafeguardAttributed
Safeguard said users should review provider usage from 16 October onward and look further back because OpenCode has not said when access began.SafeguardAttributed
Safeguard said earlier OpenCode flaw CVE-2026-22812 had a CVSS score of 8.8 and was fixed in version 1.0.216.SafeguardAttributed
Safeguard said earlier OpenCode flaw CVE-2026-22813 allowed script execution on localhost:4096 and was fixed in version 1.1.10.SafeguardAttributed
Safeguard said neither earlier OpenCode flaw has been linked to this breach.SafeguardAttributed
OpenCode is a free and open-source artificial intelligence coding agent developed by Anomaly Innovations.WikipediaConfirmed
BleepingComputer reported that OpenCode notified a small number of users that external-provider API keys were exposed in a security breach.BleepingComputerAttributed
dealroom.co published its report on Oct 18, 2026.dealroom.coConfirmed
notebookcheck.net published its report on Oct 17, 2026.notebookcheck.netConfirmed
safeguard.sh published its report on Oct 18, 2026.safeguard.shConfirmed

Could not verify

  • How many users 1.4% represents is not established.
  • Whether any exposed key was copied or used is not established.
  • Whether the breach was connected to the distillation attack is not established.
  • How the attacker reached the legacy system and how long access lasted is not established.
  • Whether OpenCode will reimburse victims is not established.
See all in Data Leaks →
Explore with AI
ChatGPT
Claude
Perplexity
Grok