An unauthorized access to OpenCode’s legacy system on October 16 may have compromised API keys from third-party AI providers, such as OpenAI, Anthropic, and Google, stored within its Console service. This incident was confirmed by OpenCode, raising concerns about potential data exposure.
Impact on OpenCode Console Users
OpenCode’s Console is a hosted service that manages API keys for users, allowing seamless integration with AI models without disclosing the keys. Affected users, who constitute 1.4% of Console’s base, have been advised via email to revoke and replace these keys immediately.
The notification, sent on October 17, emphasized the urgency of the situation with the subject line “Action Required: Potential provider key breach.” Users who did not receive this email are not impacted, as clarified by OpenCode in a public statement later that day.
Security Measures and Recommendations
OpenCode clarified that the breach is isolated to its Console service and does not affect the command-line or desktop applications, which store keys locally. Users were urged to revoke compromised keys through provider dashboards and generate new ones following guidelines from OpenAI, Anthropic, or Google.
It is also recommended to monitor provider accounts for unauthorized usage dating back to October 16 and implement spending limits or alerts to prevent future incidents. OpenCode’s advice includes assigning unique keys to each tool for better tracking and minimizing potential misuse.
Ongoing Investigation and User Concerns
Reports from users, including Colin Parsons and Preston Zeller, highlighted financial impacts from unauthorized usage of their API keys. Instances of overcharges have been shared, with claims of expenses ranging from $400 to €200 due to unauthorized activity.
OpenCode’s communication on October 17 referred to the breach as part of a larger “distillation attack,” a method used by adversaries to extract data by leveraging fake accounts and stolen credentials. The company is actively collaborating with AI providers to address this security challenge.
Despite ongoing attempts to infiltrate OpenCode’s systems, as noted by co-founder Dax Raad, the company is reinforcing its defenses. The situation underscores the urgency of robust security measures in protecting digital assets and user data.
Moving forward, the spotlight remains on OpenCode and its partners to implement effective solutions and prevent future occurrences, ensuring the integrity of user data and trust in AI services.
