Cases › security breach › LR-2026-0212
OpenCode large-scale distillation attack compromises 1.4% of Console users, stolen API keys used for unauthorised charges
Severity moderate: Other parties' data or systems were touched, and a source states how far it reached. Credentials of 1.4% of OpenCode Console users were compromised and used for unauthorised charges, a bounded scope of third-party data touched.
Earliest source we hold 2026-10-18
OpenCode disclosed to customers that a “large-scale distillation attack” compromised 1.4% of Console users, with stolen keys being used to rack up unauthorised charges.
Risk grouping: AI attacked
| Who caused it | A person or organisation “OpenCode confirmed this week that an unauthorized party broke into a legacy version of its Console, the hosted dashboard where some users stored API keys for OpenAI, Anthropic and Google.” source |
|---|---|
| Intended or not | Intended “Stolen API keys let them run thousands of dollars in AI queries on other people's accounts, and the real target wasn't the money.” source |
| Before or after release | After release “OpenCode confirmed this week that an unauthorized party broke into a legacy version of its Console, the hosted dashboard where some users stored API keys for OpenAI, Anthropic and Google.” source |
| The AI's part | Attacked “OpenCode confirmed this week that an unauthorized party broke into a legacy version of its Console, the hosted dashboard where some users stored API keys for OpenAI, Anthropic and Google.” source |
The story
1 · What it was doingOpenCode's hosted Console was a dashboard where some users stored API keys for OpenAI, Anthropic and Google so the open-source coding agent could reach those models.
2 · What went wrongA large-scale distillation attack compromised Console users' keys, and the stolen keys were used to rack up unauthorised charges on the victims' accounts.
3 · What it reached or didThe compromise reached 1.4% of OpenCode Console users, whose credentials were exposed and then used for unauthorised charges.
4 · What was doneOpenCode told customers about the compromise.
What the sources state
- What set it off exposed credentials
Others like this
Show every field, with its source and grade
The AI system
Software around the model
OpenCode Console
C one secondary source states it
What it was allowed to do
Stored API keys for OpenAI, Anthropic and Google used by the coding agent to reach those models
C one secondary source states it
Whose system
company that built the AI
D inferred by us from the described behaviour, reason shown
Stage of the model
in live use
C one secondary source states it
How it was connected
hosted dashboard storing API keys for third-party model providers
C one secondary source states it
What it was for
Hosted dashboard where users stored API keys so the open-source coding agent could reach OpenAI, Anthropic and Google models on their behalf
C one secondary source states it
What happened
Earliest source we hold
2026-10-18
A the date the source itself carries
What set it off
exposed credentials
C one secondary source states it
Who was responsible
the model provider
C one secondary source states it
Who caused it
an outside attacker
C one secondary source states it
What was done
OpenAI, Anthropic and Google revoked the compromised keys; OpenCode says refunds for the unauthorized charges are underway.
C one secondary source states it
What went wrong
security breach
D inferred by us from the described behaviour, reason shown
AI agent
an AI agent acted
C one secondary source states it
What it did
The incident was a break-in to a hosted dashboard holding API keys, not agent behaviour.
D inferred by us from the described behaviour, reason shown
Impact
Severity
moderate
D inferred by us from the described behaviour, reason shown
Kind of harm
money
C one secondary source states it
Who was affected
1.4% of OpenCode Console users; victims of stolen OpenAI, Anthropic or Google keys
C one secondary source states it
Kinds of data exposed
credentials
C one secondary source states it
Why this severity
Other parties' data or systems were touched, and a source states how far it reached. Credentials of 1.4% of OpenCode Console users were compromised and used for unauthorised charges, a bounded scope of third-party data touched.
D inferred by us from the described behaviour, reason shown
Context
Industry
Software / AI coding tools
C one secondary source states it
Notes on gaps
The source conflates two stories: a DeepSeek V4.1-Flash release note and an OpenCode Console credential compromise, plus a separate MONST3R-AI criminal tool.
LR-2026-0212 · version 5 · published 2026-10-25 after automatic checks; not yet checked field by field by a person · changes to this case · JSON