OpenCode Console breach led to unauthorized spending through user API keys
OpenCode said an attack on an older Console system affected 1.4% of users and led to unauthorized usage and charges on some connected AI accounts.
AT A GLANCE
Key points
- OpenCode said 1.4% of Console users were affected
- The company emailed every affected user
- Compromised API keys caused unauthorized usage and charges
- Separate credentials and budget caps can limit exposure
What is changing?
In an official statement on October 19, OpenCode said attackers entered an older system the previous night and affected 1.4% of OpenCode Console users. The company said it emailed every affected user and that people who did not receive a notice were not impacted.
According to TechCrunch, some Console users stored API keys used to access AI providers. Attackers used compromised keys to run requests on those accounts, creating charges for some users. OpenCode linked the incident to a large-scale model-distillation attack.
The incident shows why agent and model gateways need spending limits, key rotation, least-privilege access, and real-time usage alerts together. Teams should review provider logs, revoke affected keys, and use separate credentials and budgets for independent projects.
Explore the original sources
Source date: 19 October 2026.
Published by AI Radar: 20 Oct 2026, 10:11 (Istanbul, UTC+3).
FOLLOW THE TOPIC
Topics and tags
Share your discovery.
Send this story to a friend.
Reader comments
What do you think about this development? Share your experience or question. Comments are published after editorial approval.
Your name/nickname and comment become public if approved. Read: Privacy notice.
Loading comments…