Executive Summary
A breach at OpenCode's Console platform in mid-October 2026 exposed private API keys for OpenAI, Anthropic, and Google services belonging to approximately 1.4% of Console users. The incident was traced to unauthorized access of a legacy system that was in the process of being decommissioned. Attackers leveraged the stolen API keys to conduct large-scale, automated queries—referred to as a "distillation attack"—resulting in significant unauthorized charges and operational disruption for affected users. The breach highlights the risks associated with storing third-party credentials on developer platforms and underscores the need for robust credential management and incident response practices. Remediation efforts included revocation of compromised keys and collaboration between OpenCode, Anthropic, OpenAI, and Google to mitigate ongoing threats. No technical indicators of compromise (IOCs) have been publicly disclosed as of the time of this report. All information in this summary is based on public disclosures from Dealroom News (October 18, 2026), Cybersecurity News (October 18, 2026), and the OECD AI Incident Database (October 17, 2026).
Technical Information
The OpenCode Console breach was the result of unauthorized access to a legacy system that was in the process of being decommissioned. This system stored API keys for third-party AI providers, including OpenAI, Anthropic, and Google, which users had supplied to enable integration with the Console agent. The breach affected approximately 1.4% of Console users, specifically those who had linked external provider accounts and received direct notification from OpenCode.
The attack was characterized as a "large scale distillation attack," a term used to describe campaigns where attackers use stolen credentials to extract large volumes of model outputs from AI providers. In this case, the attackers used the compromised API keys to run automated, high-volume queries against the affected providers, resulting in unauthorized financial charges to user accounts. Individual losses ranged from hundreds to thousands of dollars, as reported by affected users.
Technical analysis of the attack aligns with several MITRE ATT&CK techniques. Initial access was likely achieved through valid account credentials or session tokens (T1078: Valid Accounts), possibly due to insufficient decommissioning procedures. Once inside, attackers accessed and exfiltrated API keys stored in the backend (T1555: Credentials from Password Stores) and used these keys to authenticate to third-party AI services (T1550: Use Alternate Authentication Material). The attackers then employed automated tools to collect large amounts of data from AI model endpoints (T1119: Automated Collection, T1213: Data from Information Repositories), resulting in resource hijacking and financial loss for users (T1496: Resource Hijacking).
No specific malware or implant was identified in the public disclosures, and there is no evidence of exploitation of a public-facing application. The attack relied on credential access and automated abuse rather than malware deployment. The tools used by the attackers were likely automated scripts or bots designed to maximize the volume of queries and data extraction, but no specific tool names or hashes have been disclosed.
The breach is part of a broader trend of attacks targeting platforms that store third-party credentials, particularly in the AI and developer tooling sector. Similar incidents, such as the Fireworks AI breach earlier in October 2026, have demonstrated the risks associated with storing secrets in shared or legacy environments. While some reporting references industrial-scale distillation attacks attributed to Chinese AI firms, there is no direct evidence linking this breach to any specific threat actor or nation-state.
The operational and financial impact of the breach was significant. Affected users experienced unauthorized charges, service interruptions due to key revocation, and the need to update applications and monitor for further suspicious activity. The incident underscores the importance of secure credential storage, timely decommissioning of legacy systems, and rapid incident response.
Affected Versions & Timeline
The breach specifically impacted users of the OpenCode Console product who had stored third-party API keys in their workspaces. The affected group represents approximately 1.4% of Console users, as confirmed by OpenCode. Only users who received a direct notification from the company were impacted; users who did not receive an email were not affected.
The timeline of the incident is as follows: Unauthorized access to the legacy system was discovered and disclosed by OpenCode on October 17-18, 2026. The company immediately notified affected users and began working with Anthropic, OpenAI, and Google to revoke compromised keys and mitigate ongoing threats. The incident remained under active investigation at the time of public disclosure, and OpenCode did not provide details on the duration of attacker access or the total number of compromised keys.
Threat Activity
The threat activity observed in this incident centers on credential theft and automated abuse of cloud-based AI services. Attackers gained access to a legacy system storing API keys, exfiltrated those credentials, and used them to conduct high-volume, automated queries against OpenAI, Anthropic, and Google endpoints. This activity resulted in unauthorized financial charges and operational disruption for affected users.
The attack method is consistent with "distillation attacks," where adversaries use stolen credentials to extract large datasets from AI models, potentially for the purpose of training competing models or conducting further malicious activity. The incident also reflects a broader pattern of targeting platforms that aggregate and store third-party credentials, increasing the risk of widespread compromise in the event of a breach.
No technical indicators, such as malware, infrastructure, or unique tactics, techniques, and procedures (TTPs), have been disclosed that would allow for attribution to a specific threat actor. The attack appears to be opportunistic and financially motivated, with a focus on resource hijacking and data extraction.
Mitigation & Workarounds
The following mitigation steps were recommended and implemented in response to the breach, prioritized by severity:
Critical: Immediate revocation and replacement of all API keys stored in affected OpenCode Console workspaces. Users were instructed to revoke compromised keys through each provider's dashboard and generate new credentials.
High: Monitoring of all linked provider accounts for unauthorized or unexpected usage. Users were advised to review recent billing records and usage logs to identify suspicious activity.
High: Updating all applications and integrations that depend on the affected API keys to use the new credentials, ensuring continuity of service and preventing further unauthorized access.
Medium: Reviewing and improving credential storage practices, including the secure handling and timely removal of secrets from legacy systems.
Medium: Accelerating the decommissioning of legacy infrastructure to reduce the attack surface and prevent similar incidents in the future.
Low: Ongoing collaboration between OpenCode, Anthropic, OpenAI, and Google to monitor for additional threats and share intelligence related to credential abuse and automated attacks.
Indicators of Compromise
No public indicators of compromise (IOCs) were available at the time of writing. Organizations are advised to validate any future indicators before enforcement and to monitor for updates from trusted threat intelligence sources.
References
Dealroom News, October 18, 2026: https://dealroom.co/news/163473-opencode-breach-drains-users-ai-keys-as-platforms-holding-customer-crede/
Cybersecurity News, October 18, 2026: https://cybersecuritynews.com/opencode-security-breach/
OECD AI Incident Database, October 17, 2026: https://oecd.ai/en/incidents/2026-10-17-9e2d
About Rescana
Rescana provides a third-party risk management (TPRM) platform designed to help organizations identify, assess, and monitor risks associated with external vendors and service providers. Our platform enables continuous monitoring of vendor security posture, automated risk assessments, and actionable insights to support incident response and credential management best practices. For questions about this report or to discuss how our capabilities can support your risk management program, please contact us at info@rescana.com.
