OpenCode told users on 17 October that an unauthorised party reached a legacy Console system the company was in the process of retiring, and that provider API keys stored there — OpenAI and Anthropic, with Google named in some of the notifications — may have been exposed.

The affected group is about 1.4 percent of Console users, and only those who had linked an outside provider. Everyone affected was emailed individually, and the notice told people who did not receive one that they were not impacted.

The thing that was stolen spends money

This is what separates a key breach from a data breach. A stolen record sits somewhere until somebody uses it. A stolen API key bills the owner from the moment it is used, at whatever rate the thief chooses to work.

Several users reported charges they did not make, one as high as $1,700. For some of them, the bill was the notification. The provider's usage dashboard registered the theft before the vendor's email arrived.

That also sets the clock. Rotation is not a tidy-up for later: every hour an exposed key stays live is an hour somebody can spend against it.

The framing, and what is behind it

OpenCode describes the incident as a "large scale distillation attack" — that is, keys taken in order to pump a competitor's model for training data rather than to resell.

It is a plausible reading, and it fits a pattern we have covered twice: a distillation campaign that tied 3,500 accounts together through one fixed prompt, and a disruption in July that was still running on other infrastructure in September.

But OpenCode has not published the evidence for the link, and a reader should hold the two claims apart. "Keys were exposed" is established by the company's own notification. "This was a distillation operation" is the company's characterisation of motive, and motive is the hardest thing to establish early.

1.4 percent of what

The figure doing the most work in the coverage is 1.4 percent, and it is a percentage without a denominator. OpenCode has not published how many Console users it has, so the share converts to a number only for people inside the company.

One point four percent of ten thousand is a hundred and forty developers. Of a million, it is fourteen thousand. Both are consistent with everything that has been said, and the choice to report a proportion rather than a count is the choice that makes the incident sound smallest while remaining true.

It is also the wrong unit for the risk. The thing that matters is not how many people were affected but how many keys were exposed and what those keys could spend, and neither has been given.

What has not been said

A week of coverage has not produced a root cause. OpenCode has not described how the legacy system was reached, how long the intruder was inside, or how many keys were involved. There is no post-mortem. The company says the incident is ongoing and that it cannot share more, and that it is working with Anthropic, OpenAI and Google.

The legacy-system detail deserves its own line. The system was being decommissioned. Systems in that state tend to have reduced monitoring, deferred patching and an owner who has already moved on, while retaining production credentials for exactly as long as nobody finishes the job.

What to do

  • If you stored a provider key in OpenCode Console, rotate it now whether or not you received an email. Rotation costs you ten minutes and the alternative is open-ended.
  • Check provider usage dashboards for the period since mid-October, not just your invoice total. Unusual call patterns show up there before billing closes.
  • Replace the key everywhere it is deployed before revoking the old one, or you will take an outage on top of an incident.
  • Scope keys properly on reissue. A key limited to one model, one project and a spend cap is a much smaller loss than an account-wide one.
  • Stop storing provider keys in third-party consoles where the product allows a different pattern. This is the second supply-chain story this week where what leaked was a credential somebody else was holding for you.

What is not established

  • How the intruder reached the legacy Console system. No explanation has been published.
  • How many keys were exposed, or how many were used. 1.4 percent of Console users is a population, not a key count.
  • Whether this really was distillation. That is OpenCode's framing and no evidence for it has been shown.
  • Whether Google keys were affected. The company's notifications are reported inconsistently on this point, and Google is also named as a partner in the response.
  • How long the intruder had access.
  • Whether anything beyond provider keys was exposed. OpenCode says its investigation has found no evidence of that so far, which is a statement about what it has looked at.