# opencode-console-breach-saved-openai-anthropic-and-google-provider-keys: OpenCode Console Breach: Saved OpenAI, Anthropic and Google Provider Keys Exposed for 1.4% of Console Users Through a Legacy System

> OpenCode Console Breach: Saved OpenAI, Anthropic and Google Provider Keys Exposed for 1.4% of Console Users Through a Legacy System is a high-severity credential theft issue in OpenCode Console, an AI agent. Affected: OpenCode Console (hosted) workspaces with external provider keys linked; 1.4% of Console users notified by email. Local opencode CLI installs not reported affected..

- **Canonical URL:** https://catalog.anomity.ai/vuln/opencode-console-breach-saved-openai-anthropic-and-google-provider-keys
- **Aliases:** ti-134
- **Severity:** high
- **Attack type:** Credential theft
- **Component:** OpenCode Console (AI agent)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-10-17
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/opencode-console-breach-saved-openai-anthropic-and-google-provider-keys

## Summary

OpenCode disclosed on X on 17 October 2026 that it had a security breach the previous night "related to a large scale distillation attack" affecting 1.4% of OpenCode Console users, specifically a subset who had external providers linked; it emailed affected users that morning, said users without an email were not impacted, called the incident ongoing, and said it was working with Anthropic, OpenAI and Google on remediation. The notification email, pasted by users on Hacker News, says OpenCode "identified unauthorized access to a legacy system that we were in the process of decommissioning" and that third-party provider keys (e.g. OpenAI, Anthropic) saved in the workspace may have been exposed, and asks users to revoke and replace them through the provider's dashboard. Console stores provider keys server-side and routes requests through its gateway, so workspace members may never have seen the keys they need to rotate. OpenCode has not said how access was gained, how many keys were exposed, or what "distillation attack" means here; the reading that stolen keys were used to harvest frontier-model output for training is press interpretation. Some users reported rapidly draining provider balances and bills in the hundreds of dollars; those charges are individual reports, not confirmed losses. Reporting places the exposure in the hosted Console and Zen gateway rather than the local opencode CLI, which has not been confirmed.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| OpenCode Console (hosted) workspaces with external provider keys linked; 1.4% of Console users notified by email. Local opencode CLI installs not reported affected. | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if you run OpenCode Console (hosted) workspaces with external provider keys linked; 1.4% of Console users notified by email. Local opencode CLI installs not reported affected..

## How do I fix it?

For every OpenCode Console workspace in use (admins should check on behalf of members), open the Providers tab and revoke and replace each linked OpenAI, Anthropic, Google or other provider key at the provider first, then rotate it in Console; rotate even without a notification email if the key was ever saved there. Review provider usage for the past several days for unfamiliar models, output-token spikes or unexpected regions, and set a spend cap on the provider side. Search repositories, CI secrets and shell history for the same keys, since one key is often reused across tools. Going forward, prefer per-tool, per-workspace provider keys with budgets over one shared org key, so a third-party gateway breach is contained to that key.

## How do I find every machine running OpenCode Console?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run OpenCode Console and which version, then enforce a policy on it.

## References

- article: https://x.com/opencode/status/2111519637049319818

## Related vulnerabilities

- [symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot](https://catalog.anomity.ai/vuln/symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot) — high
- [manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction](https://catalog.anomity.ai/vuln/manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction) — high
- [GHSA-wp6x-29qx-fpr7](https://catalog.anomity.ai/vuln/ghsa-wp6x-29qx-fpr7) — high
- [mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across](https://catalog.anomity.ai/vuln/mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across) — critical
- [anthropic-september-2026-threat-report-fake-claude-code-installers-and](https://catalog.anomity.ai/vuln/anthropic-september-2026-threat-report-fake-claude-code-installers-and) — high
- [ghostjacking-a-firewall-block-log-is-an-injection-channel-because-the](https://catalog.anomity.ai/vuln/ghostjacking-a-firewall-block-log-is-an-injection-channel-because-the) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=opencode-console-breach-saved-openai-anthropic-and-google-provider-keys