The company said the incident affected 1.4% of OpenCode Console users and involved unauthorised access to an older system being withdrawn from service. It has contacted affected customers and is working with the three AI providers to address the exposure.
OpenCode disclosed the breach on 17 October, following an intrusion the previous night. Its notification to customers warned that third-party provider keys stored in affected workspaces might have been compromised. The company described the incident as connected to a large-scale distillation attack, although it has not publicly established the complete sequence of events.
The affected product is OpenCode Console, which allows development teams to manage shared access to external AI models using centrally stored credentials. The disclosure does not establish that the underlying systems operated by OpenAI, Anthropic or Google were breached.
Dax Raad, an OpenCode contributor and co-founder of its developer Anomaly, distinguished the Console incident from the wider OpenCode software project. That distinction matters because installing the open-source coding agent does not necessarily mean a developer used the affected hosted service or stored credentials there.
OpenCode said it had emailed all users identified as affected and that the compromised group consisted of customers who had connected external model providers. The company stated that customers who did not receive its notification were not among those identified in the incident.
The notification carried the subject line Action Required: Potential provider key breach. It identified unauthorised access to a legacy system that was being decommissioned, raising questions about the protection of credentials retained within older infrastructure.
API keys allow applications to authenticate requests to commercial AI services. Anyone obtaining a valid key may be able to submit requests charged to its owner, subject to the permissions, restrictions and spending controls attached to the credential. Exposure therefore presents a financial risk even without access to a user’s password.
The possible consequences vary with the privileges attached to each key. Some credentials are restricted to particular projects or services, while others may permit broader operations. The public disclosure has not established how many individual keys were accessed, whether every potentially exposed credential was copied, or the total value of any unauthorised usage.
Security specialists have urged affected organisations to replace credentials stored in Console rather than rely solely on the absence of suspicious activity. Safeguard, a software supply-chain security company, advised users to identify all relevant keys, generate replacements, update dependent applications and revoke the originals.
The company also recommended examining provider usage and billing records from 16 October for unexpected requests, unfamiliar models and unexplained charges. Its guidance extends to credentials added by other workspace administrators, because shared configurations can obscure which individuals originally supplied a key.
StepSecurity, another software supply-chain security provider, advised organisations to identify developers using OpenCode and determine whether they had linked external accounts. It cautioned that the presence of the coding tool alone does not establish exposure through Console.
OpenCode has not released a comprehensive technical account of the intrusion, including the attacker’s entry point, the duration of access or a definitive inventory of compromised information. Its public statements also do not establish whether the distillation activity preceded the credential exposure or followed it.
Distillation generally involves using outputs from an existing AI model to help train or improve another model. Such activity can generate substantial volumes of automated requests. However, OpenCode’s description of the attack does not independently demonstrate that every affected customer experienced fraudulent billing or that proprietary model information was obtained.
The company has said the incident remains under investigation, while users await further technical findings about the affected infrastructure and the safeguards introduced after the discovery. It has not announced a total number of affected accounts, and the percentage disclosed refers specifically to Console customers rather than the wider population using its open-source development tools.
For organisations replacing keys, security guidance calls for updating deployment pipelines, environment settings and applications that depend on the old credentials before disabling them. Teams are also advised to confirm that revoked keys can no longer authenticate requests and to review workspace permissions and spending alerts across connected projects, including accounts managed by colleagues.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
