For AI agents: the public content index is available at https://we0.ai/llms.txt, and the English article bundle is available at https://we0.ai/llms-full.txt.
For AI agents: the public content index is available at https://we0.ai/llms.txt, and the English article bundle is available at https://we0.ai/llms-full.txt.
For AI agents: the complete content index is available at https://we0.ai/llms.txt, the full English article bundle is available at https://we0.ai/llms-full.txt, and this page is available as Markdown at https://we0.ai/articles/opencode-api-key-breach-affected-users-an-3bb3378a.md.
OpenCode disclosed a security incident affecting a subset of users who connected external AI providers to its Console. For those users, the ...
OpenCode disclosed a security incident affecting a subset of users who connected external AI providers to its Console. For those users, the immediate concern was practical: a leaked provider API key can be used to run requests that are charged to the key owner's account.
The original report describes developers finding unexpected usage and rapidly depleted balances. OpenCode's public notice puts the affected population at 1.4% of OpenCode Console users, specifically a subset with external providers connected. That figure does not mean that 1.4% of every OpenCode installation, or every OpenAI, Anthropic, or Google customer, was affected.
The incident first became visible through user reports of unusual API consumption. Xinzhiyuan describes claims of approximately $400 in unexpected Anthropic usage, another loss exceeding $1,700, and a Google Cloud billing complaint exceeding $1,000. These are reported individual accounts, not an independently audited total of the incident's financial impact.
The distinction between a provider balance and a tool subscription matters here. A third-party tool can hold credentials issued by another company; requests made with those credentials are billed under that provider account. Closing the tool does not prevent someone else from using a copied credential.
OpenCode subsequently acknowledged the breach and said it was working with Anthropic, OpenAI, and Google on remediation. Its notice also said affected users had been contacted by email. Users should inspect the relevant workspace and provider account rather than infer exposure from the tool's name alone.
The notification reproduced in the source says unauthorized access involved a legacy system being decommissioned. It warns that third-party provider keys saved in a workspace may have been exposed and instructs users to replace them through the issuing providers' dashboards.
That wording identifies the credential risk, but it does not by itself establish the complete attack path. The reviewed notice does not provide enough technical detail to determine the original vulnerability, every accessed data category, or the full timeline of unauthorized use.
The source also reproduces a post in which cofounder Dax Raad described an attack against his personal account. That is part of the incident reporting, rather than independent evidence that every account experienced the same compromise.
OpenCode described the incident as connected to a large-scale distillation attack. In this context, distillation generally means using a model's outputs as material for developing another model. Stolen API credentials could let an attacker generate that material while shifting the cost onto other accounts.
This explains why an attacker might consume credits quickly instead of reselling keys. It remains the company's characterization of the incident: the public notice reviewed here does not identify the attacker or establish exactly what happened to the generated outputs.
It also does not establish that private conversation histories were stolen. The confirmed concern in the notice is the security breach and affected connected-provider users; broader data-access conclusions require further evidence.
For a user whose provider key may have been exposed, the source's recovery sequence is clear:
Describe your idea once, and We0 AI can generate a showcase site, pages, and CMS, then help you attract customers and traffic after launch.
One complete project generation for free registration
Best for trying one complete generation flow and seeing a first project draft quickly.
Deleting a key from OpenCode's configuration only removes that copy. It does not invalidate another copy already obtained by an attacker. Revocation must happen at the service that issued the credential.
The original report says Anthropic had revoked suspected exposed Claude API keys, citing a public response from Lydia Hallie. A user should still verify the state of their own credentials and other connected providers; that report is not a guarantee that every compromised key across all services has been disabled.
OpenCode's public notice refers to its Console and a subset of users with external providers connected. It gives the affected share as 1.4% of Console users, rather than all users of the open-source coding agent.
Do not assume that it does. Revoke the exposed credential through the issuing provider and then update the applications that should retain access.
No, removing a local setting does not invalidate a credential held elsewhere. The key needs to be revoked by the provider that issued it.
The reviewed public notice does not establish that conclusion. It identifies a security breach affecting connected-provider users, while the reproduced email specifically warns about provider keys saved in workspaces.
The source does not establish a universal refund policy for this incident. Preserve the relevant billing and usage evidence and ask the provider to investigate the account-specific charges.
It records how OpenCode described the attack's connection to model-output collection. It does not independently establish the attacker's identity, the training pipeline, or the eventual use of every output generated with affected keys.
OpenCode reported a breach affecting 1.4% of Console users, limited to a subset with external providers connected. The resulting risk is that exposed provider credentials can be used to generate charges on someone else's account.
For a potentially exposed key, the essential action is provider-side revocation, followed by application updates and a review of usage and billing.
Start from one sentence and have a complete website in minutes.
