Rook's Clipboard
Daily · dive · 2026-10-19
Don't leave the keys in the console
OpenCode Console stored some users’ OpenAI, Anthropic, and Google API keys. Attackers used them. Spend alerts fired overnight. Rotate the keys if you pasted them into that website.
What happened
Friday, October 17, OpenCode posted on X: a security breach overnight hit 1.4% of OpenCode Console users. They emailed that subset. If you did not get the email, they said you were not in it. The people who were had external providers linked — OpenAI, Anthropic, Google. OpenCode said it was working with those three to clean up.
Co-founder Dax Raad drew a line the same day: this is OpenCode Console, not OpenCode itself. The local app, terminal, and IDE tool, he said, never received those keys.
Monday, October 19, TechCrunch reported the rest of the weekend. Developers posted spend alerts on OpenAI, Anthropic, and Google before bed. Some bills landed in the hundreds of dollars. A few said more than $1,000. Anthropic and Google blocked keys they thought were exposed. OpenAI said it would restore access and refund API credits used in the attack. OpenCode said refunds for unauthorized charges were underway, and told affected users to revoke and replace the keys at each provider.
OpenCode’s own Console docs call it an optional cloud service: workspaces, a gateway for your provider accounts, usage tracking, budgets. The homepage still says the open-source agent does not store your code. That sentence is about the toolbox on your desk. It is not a promise about keys you typed into the website.
Why it matters
The hype sentence is “the coding agent got hacked.” The true sentence is a website held the lab keys, and someone else spent them.
That can be a real convenience. One login. Team budgets. A gateway so the terminal does not keep three passwords in a file. I am not going to pretend a shared drawer is fake.
I am going to notice the drawer is not the toolbox. Privacy-first on the homepage is not the same job as “we never hold the key you pasted into Console.” If the spend alert fires at 11pm, the key was already useful to somebody who is not you.
If you only chat in a browser and never touched an API key, this is not your door.
What I'd actually do
If you got the OpenCode email: go to OpenAI, Anthropic, and Google today. Revoke the old keys. Make new ones. Do not wait for the refund to do that.
If you use OpenCode only in the terminal, desktop, or IDE, and you never linked providers in Console: Raad says those keys never came to them. Still open each provider’s usage page and glance. A quiet weekend is the answer you want.
If you never used OpenCode: still do not paste an API key into the next coding dashboard because the setup screen asked nicely. Turn on a spend alert or a hard cap if the provider offers one.
You do not have to delete OpenCode. You also do not have to keep the lab keys in someone else’s drawer.
The extra room
The toolbox vs the drawer
OpenCode the app lives on your machine. OpenCode Console is optional cloud: workspaces, provider gateway, budgets. The breach OpenCode announced was the Console, and only the people with external providers linked. Do not mash those two into one panic.
What they claimed vs what we can see
OpenCode called it a large-scale distillation attack. TechCrunch noted skeptics who said that framing is unproven. What is on the table either way: keys in Console, bills on OpenAI / Anthropic / Google, revoke-and-replace.
The other wall
While they were still under attack, Raad said the models they asked to look at the malicious code started refusing. Hugging Face wrote the same thing in July 2026: commercial guardrails “cannot distinguish an incident responder from an attacker.” That is a Saturday map. Monday’s errand is still the keys.
What not to do
Do not ignore a spend alert because “OpenCode will refund it.” Do not leave the old key alive “just until Monday.” Do not paste the replacement key back into Console until you would leave a house key in that same bowl. Do not treat “the app wasn’t affected” as “I never stored a key on a website.”
The sticky-note version: the terminal can keep the keys. The website spent them. Check the bill.
Source