OpenCode breach may have exposed saved model-access keys
OpenCode says an intrusion into an old Console system may have exposed provider keys belonging to a subset of users. The company has contacted affected accounts and is working with model providers. Copies of stolen keys can still make calls outside Console, so spending limits inside the service do not cover every possible use of the credentials.
Artificial Intelligence··Midday
Provider keys in the old Console system
A breach disclosed by OpenCode, an open-source coding tool, concerns credentials stored in its hosted Console service. The company said on 17 October that provider keys belonging to 1.4 per cent of Console users may have been exposed. The affected users had connected their own model-provider credentials to workspaces. OpenAI, Anthropic and Google model access can be charged to the account owning such a key.[1], [2]
Console lets teams share model access and set budgets. OpenCode attributed the intrusion to a legacy system it was retiring and said affected users had received email notifications. Its description limits the affected group to part of the hosted service's users; it does not establish exposure for everyone running the local coding agent.[1]
The company links the intrusion to model training
OpenCode said it was working with Google, OpenAI and Anthropic and linked the incident to a large-scale distillation attack. Distillation uses a model's answers to train another model. In this case, the company attributes the intrusion to an effort to collect those answers through other people's credentials. It has not publicly established the attacker's identity, initial entry route or the number of keys taken. The total Console user count is also undisclosed, leaving the percentage without an equivalent account count.[1]
Copied keys remain usable outside Console
Cyera security researchers Adam Ochayon and Yuval Yogev call for replacing affected credentials at the model provider. A copy remains usable directly with that provider after the original is removed from Console. Budgets set in Console apply to requests routed through OpenCode, leaving calls made elsewhere outside those limits. Replacement keys also need to reach any other application or automated job that used the same credential.[1]
The researchers recommend checking usage and billing from 16 October for unfamiliar model calls and unusual increases. Users have described unauthorised charges, but a verified total loss has not been published. One user described 355 euros in Anthropic charges and another reported about 200 euros in Google usage. The latter also described a project suspension for abuse. Those users said provider alerts had arrived before OpenCode’s notification. Each amount concerns a separate user account of the incident. OpenCode's notification and the revocation of provider keys are separate parts of its response to the exposure.[1], [2]
