OpenCode Console breach exposes AI provider API keys

OpenCode, the open source AI coding agent developed by Anomaly, confirmed on Saturday 17 October 2026 unauthorized access to OpenCode Console, the service that holds model providers’ API keys on behalf of teams. The OpenAI, Anthropic and Google keys saved in the workspaces of some users may have been exposed, and several users are already reporting unauthorized charges.

The news was reported by BleepingComputer, Infosecurity Magazine and The Hacker News; the details that follow come from the first two, which quote the notice sent to users and statements by the project’s leaders.

What happened

According to Infosecurity Magazine, the Console lets teams share access to AI models through centrally managed credentials: instead of handing provider keys to individual developers, the Console stores them for each workspace and uses them to authenticate requests to the providers.

The email to affected users, made public by some of them on Reddit and Discord, mentions unauthorized access to a legacy system that was being decommissioned and warns that third-party provider keys saved in the workspace may have been exposed. According to BleepingComputer, the same email gives 17 October 2026 at 00:30 UTC as the earliest possible time of exposure and states that no other data appears to have been exposed.

The figures given by OpenCode:

• 1.4% of Console users affected, only those with external providers linked;
• all affected users were notified by email: according to the project, anyone who did not receive it is not affected;
• Dax Raad, co-founder of Anomaly, specifies that the incident concerns only the Console, not OpenCode as a tool.

OpenCode links the incident to a large-scale distillation attack: the massive, unauthorized use of powerful models to collect their answers and train smaller models. According to Raad, quoted by BleepingComputer, the attackers targeted the company’s systems for at least 48 hours using AI agents. The sources do not explain how the legacy system was accessed.

Consequences for users

According to BleepingComputer, users report rogue charges ranging from a few hundred dollars up to 1,700 dollars in a single night, and some Google Cloud projects were suspended by Google for “abusive activity consistent with hijacked resources”. OpenCode’s notice mentions the possibility of reimbursement. OpenCode says it is working with Google, OpenAI and Anthropic on the incident, without further details.

Only BleepingComputer reports a detail about the response: the internal investigation reportedly stalled when the AI models used by OpenCode began refusing requests because of their built-in safeguards, and the situation stabilized with OpenAI’s Daybreak security model.

A second story: RCE fixed without an advisory

On 19 October Pillar Security disclosed a remote code execution vulnerability in OpenCode; it is reported only by Infosecurity Magazine, and according to researcher Eilon Cohen it is unrelated to the Console breach.

• Affected versions: 1.0.137 to 1.18.32, on Windows and WSL.
• Vector: an attacker-controlled remote MCP server can run arbitrary code on the developer’s machine during the MCP OAuth authentication, with no further interaction or consent.
• Cause: on Windows, a dependency used to open URLs passed them to PowerShell without proper escaping, and the shell interpreted part of the URL as a command. The payload can sit inside a legitimate-looking HTTPS URL, so checking the URL scheme is not enough.
• Fix: version 1.18.33, released on 28 September 2026, which adds the scheme check and updates the dependency to a version that quotes the URL correctly. According to Pillar, the dependency update is the decisive part.
• No CVE and no security advisory: Pillar reported it at the end of August through a GitHub Security Advisory; a month later Anomaly replied that malicious MCP servers are outside its threat model. Pillar suggests a CVSS 9.8 score and warns that scanners and dependency alerts will not flag vulnerable installations.

Indicative MITRE ATT&CK mapping, derived from the reported facts: T1078.004 (Valid Accounts: Cloud Accounts) and T1496 (Resource Hijacking) for the use of the stolen keys; T1059.001 (Command and Scripting Interpreter: PowerShell) for the RCE vulnerability.

Impact for European and Italian companies

AI provider API keys are credentials in every sense: whoever holds them spends the company’s budget and acts with its account. With platforms that hold them on behalf of teams, the security of those keys also depends on an external supplier and its systems, including the ones being decommissioned.

For NIS2 entities, Article 21 requires managing supply chain security: AI development tools and services that store credentials must be inventoried and assessed like any other supplier. The RCE fixed without a CVE shows a practical limit: with no advisory, CVE-based vulnerability management does not see it, and you need to know which versions are installed.

What to do now

1. Check whether you are affected: search your inbox for the email with the subject “Action Required: Potential provider key breach”. Even without the email, review your keys as a precaution.
2. List every key from OpenAI, Anthropic and Google Gemini ever saved in a Console workspace, including those added by other admins.
3. Review usage and billing with each provider at least from 16 October: spikes, models you do not use, unexpected charges. On Google Cloud, also check for suspended projects.
4. Create the new keys, then revoke the old ones, even if they show no suspicious usage. Update CI/CD pipelines, environment files, agent configurations and team workstations, then verify that revoked keys return an authentication error.
5. Restrict the keys: only the projects and APIs strictly needed, spending caps and budget alerts. If you keep using the Console, link a dedicated, restricted key, never the production one.
6. Update OpenCode to 1.18.33 or later on Windows and WSL and connect only trusted MCP servers.

Steps 1–5 follow the guidance published by Safeguard and reported by Infosecurity Magazine.

How ARXDOME helps

ARX Sentry keeps the software inventory of computers and servers, so you know where OpenCode is installed and in which version even when there is no CVE, and it collects logs and security events: suspicious executions and blocked outbound traffic reach the SOC pages. ARX Horizon enriches connections with the reputation of destination addresses.

Last updated: 20 October 2026