OpenCode lost its users’ AI keys. The bills arrived before the email.

01 What happened at OpenCode

Scope matters here. Raad said the breach involved "the OpenCode Console, not OpenCode itself" [ Infosecurity 2026 ] . Console is the hosted service that lets a team share access to AI models through centrally managed keys. The command-line agent on a developer’s laptop was not the entry point. Only Console users who had linked an external provider were affected, and OpenCode says everyone affected got an email [ OpenCode 2026 ] .

1.4% sounds small. OpenCode’s chief executive told a Y Combinator interview in July 2026 that the product had about 13 million monthly active users. Console is a subset of those, and OpenCode has not said how many keys left. Nobody outside the company knows the real count yet.

02 Why an attacker wants your AI key

A stolen password gets an attacker into one account. A stolen AI key gets them compute, billed to you, under your good name. Distillation shows why that is worth industrial effort.

Distillation trains a cheaper model on the answers of a stronger one. Every lab does it with its own models. Doing it to someone else’s model takes millions of queries, and the provider bans accounts that look like it. In February 2026 Anthropic said three AI labs had run over 16 million exchanges with Claude through about 24,000 fraudulent accounts, routed through proxy networks built so that a banned account was replaced instantly [ Anthropic 2026 ] . Anthropic said it was building classifiers and fingerprinting to spot the pattern.

The distillation label is OpenCode’s own. It has published no evidence tying the stolen keys to a specific campaign, and no outlet has confirmed it independently [ StepSecurity 2026 ] . The motive barely changes your exposure. Whether the key trains a rival model or mines someone’s side project, the damage lands on your bill, your provider standing and any data your account can reach.

03 Where your keys live today

OpenCode was breached through a system it was "in the process of decommissioning". That phrase describes half the findings we report. Retiring a system is the moment nobody owns it. The new platform gets the monitoring. The old one keeps its credentials, its open ports and its copy of the data until the day someone finally turns it off.

Now count where your company’s AI keys sit. In most engineering teams one OpenAI or Anthropic key rarely stays in one place:

• Developer machines. Coding agents keep keys in local config. For OpenCode that is ~/.local/share/opencode/auth.json, and every provider listed there is a credential [ StepSecurity 2026 ] .
• Hosted tools. Console-style services, AI gateways, observability tools and chat front ends that store a key so the team can share it. Each one is a vault you do not run.
• Pipelines and repositories. CI secrets and, too often, the git history. GhostAction’s October wave searched commits specifically for Anthropic, OpenAI and OpenRouter keys.
• Trials nobody cancelled. The tool someone linked for a week in spring, still holding a key with no spend limit.

Most teams share one key across all of these. Then one breach anywhere means rotating everywhere, and nobody can tell from the usage dashboard which tool sent which request.

04 Five checks for this week

If anyone in your company used OpenCode Console, start with the first item today. The rest apply whether OpenCode touched you or not, and an IT lead can finish them in a week.

OpenCode did the notification right: affected users got an email within hours, with a clear subject line. The keys still worked for whoever took them until each user rotated. Your exposure depends on how many places hold your keys and what each one can spend. We can map that in 14 days. You get every location of every AI and cloud credential we can reach, what each can spend and access, and the change that closes each path. Start with your Threat Map, from $5,000. Enterprise-grade. Not enterprise-priced.