Open-source AI coding tool OpenCode has disclosed a cybersecurity incident in which attackers breached its legacy system and leaked some users’ API keys.
The attack targeted OpenCode Console, a hosted platform that allows users to access other AI models, including OpenAI, Anthropic, and Google Gemini.
It stores credentials to authenticate with connected providers and injects them into requests forwarded through its gateway.
AI coding tool OpenCode exposes users’ API keys
According to OpenCode, the cyber attack exposed keys users stored in the Console but did not compromise the command-line tool or OpenCode itself.
“When a hosted gateway gets hit, always start with the source keys,” said Eli Ainhorn, Senior AI Vulnerability Researcher at Noma Security. “You need security tooling that gives you instant visibility to map exposed credentials, revoke provider-side keys, and then push containment to the endpoint. That’s how you actually stop the blast radius.”
The AI coding tool company described the cyber incident as a large-scale distillation attack. However, users who neither received the notification email nor had linked external providers should consider themselves unaffected.
“We had a security breach last night related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users,” OpenCode posted on X. “We have notified them all this morning via email.”
A distillation attack involves querying frontier AI models and generating outputs to train or improve another, often at a fraction of the cost of developing comparable capabilities from scratch.
Operators in countries restricted from accessing U.S. technology may use intermediary services known as LLM gateways or proxy networks to route requests through third-party infrastructure to obscure their identities or locations. However, no concrete evidence currently shows that the OpenCode incident was a distillation attack.
Cybercriminals may also resell unauthorized access to these models, leaving legitimate account holders facing unexpected usage charges. During the OpenCode attack, some users reported unauthorized costs ranging from hundreds to thousands of dollars. In one case, a user reported unauthorized charges of up to $1,700.
“The distillation link shows what these keys are worth. A stolen model key isn’t used to break in. Its value is running large volumes of valid requests on someone else’s account,” said Shreyans Mehta, co-founder and CTO at Cequence Security. “That traffic passes authentication every time, so the warning signs are behavioral, such as sudden spikes in volume, unfamiliar models or usage at odd hours. Security teams should rotate any key that ever touched Console, put a spending cap and a single project scope on every key, and monitor how each one is used rather than assuming a valid key means a legitimate caller.”
Meanwhile, OpenAI and OpenCode have pledged to reimburse customers for credits consumed through unauthorized usage linked to the suspected distillation attacks.
“… we already contacted everyone, refunds are already underway and I just want to make sure people didn’t miss an email,” said the open-source AI coding tool co-founder Dax Raad.
Additionally, OpenCode has advised impacted users to revoke the compromised keys, create a new one, and reauthorize each provider. However, deleting the compromised key from the Console does not terminate the threat actor’s access.
“Security teams should treat AI provider keys like any other privileged credential by rotating anything that was linked to OpenCode Console, inventorying which agents and developer tools hold or broker these keys, and scoping them tightly with spending limits and usage alerts. Longer term, they need visibility into how AI tools across their environment are accessing frontier models in the first place,” said Chris Hughes, Vice President of Security Strategy at Noma Security.
The AI coding tool company also advised impacted customers to review usage and billing for unfamiliar requests dating back to October 16. They should also set spending limits and create a unique API key for each AI coding tool provider to minimize the potential impact if any key is compromised.
Meanwhile, Anthropic and Google have already blocked the compromised keys to protect their customers’ accounts from unauthorized use. OpenCode also says it is working with Anthropic, OpenAI, and Google to address the incident.
So far, the company has not disclosed the threat actor’s identity, how they gained access, or how many users were affected. While the AI coding tool has about 16 million active monthly users and only 1.4% of its customers were affected, it remains unclear how many had saved their API keys in the Console or had a linked external provider. Nevertheless, OpenCode says an investigation is still in progress, and updates may be available soon.
Autonomous AI agents run amok
Raad says that the AI coding tool was still under intense pressure from automated agents, as late as October 18. OpenCode blocked the attacks, which lasted up to 48 hours, by activating its built-in security safeguards.
In July 2026, Hugging Face thwarted an attack on its production infrastructure by an autonomous AI agent. While the incident was ultimately traced to OpenAI agents conducting internal cybersecurity evaluations with reduced safeguards, it demonstrated how autonomous AI agents could circumvent security safeguards or even be exploited to enable cyber attacks.
In early October 2026, numerous South Korean banks were hit by a wave of AI-powered cyber attacks, involving a Chinese-developed AI agent and Anthropic’s Claude Code, exposing the personal details of over 140,000 people.
