OpenCode Discloses Security Breach Exposing Third-Party API Keys in Console Workspaces
OpenCode revealed on October 17 that a security breach affected 1.4% of its Console users, potentially exposing third-party API keys stored in impacted workspaces. The company attributed the incident to a large-scale distillation attack and is collaborating with Anthropic, OpenAI, and Google to mitigate the fallout.
The breach targeted a legacy system that OpenCode was already phasing out, granting unauthorized access to provider keys linked to external services, including those from OpenAI and Anthropic. While the exact number of exposed keys remains undisclosed, OpenCode notified all affected users via email, confirming that those who did not receive a message were unaffected. The company emphasized that the breach was limited to Console users with linked external providers, not its entire user base.
Distillation attacks, which involve training one AI model using outputs from another, have been a growing concern in cybersecurity. Anthropic previously warned about such campaigns, where attackers make repeated requests to extract model capabilities without authorization. However, OpenCode has not confirmed whether the exposed credentials were used in this manner, nor has it provided details on the attack’s duration, entry point, or the threat actor involved.
Affected users were advised to revoke and replace compromised keys through their provider dashboards, update dependent applications, and review recent usage for suspicious activity. OpenCode acknowledged that the incident was still under investigation at the time of disclosure, withholding further technical details pending a fuller report.
The breach underscores the risks of exposed API keys, a recurring issue in cybersecurity, though OpenCode has not linked this incident to prior cases of publicly leaked credentials. The company’s statement framed the exposure as a potential rather than confirmed compromise, leaving key questions about the attack’s scope and impact unanswered.
Source: https://cybersecuritynews.com/opencode-security-breach/
Anthropic TPRM report: https://www.rankiteo.com/company/odeai
OpenAI TPRM report: https://www.rankiteo.com/company/openai
OpenCode TPRM report: https://www.rankiteo.com/company/open-code-mission
"id": "odeopeope1792297427",
"linkid": "odeai, open-code-mission, openai",
"type": "Breach",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '1.4% of Console users (exact '
'number undisclosed)',
'industry': 'Technology/AI',
'name': 'OpenCode',
'type': 'Company'}],
'attack_vector': 'Distillation attack',
'customer_advisories': 'Email notifications sent to affected users; '
'unaffected users confirmed via non-receipt of '
'notification.',
'data_breach': {'sensitivity_of_data': 'High (API keys for AI services)',
'type_of_data_compromised': 'API keys (third-party provider '
'keys)'},
'date_publicly_disclosed': '2023-10-17',
'description': 'OpenCode revealed a security breach affecting 1.4% of its '
'Console users, potentially exposing third-party API keys '
'stored in impacted workspaces. The breach was attributed to a '
'large-scale distillation attack and involved unauthorized '
'access to provider keys linked to external services like '
'OpenAI and Anthropic.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'API key exposure',
'data_compromised': 'Third-party API keys (OpenAI, Anthropic, '
'Google)',
'operational_impact': 'Affected users required to revoke and '
'replace compromised keys',
'systems_affected': 'OpenCode Console workspaces (legacy system)'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Risks of exposed API keys and legacy system '
'vulnerabilities; importance of phasing out outdated '
'systems and proactive key management.',
'post_incident_analysis': {'corrective_actions': 'Phasing out legacy system, '
'improving API key security, '
'and collaborating with '
'third-party providers for '
'mitigation.',
'root_causes': 'Legacy system vulnerability '
'exploited via distillation attack'},
'recommendations': 'Users should revoke and replace compromised API keys, '
'update dependent applications, and review recent usage '
'for suspicious activity. Companies should enhance '
'security for legacy systems and monitor for distillation '
'attacks.',
'references': [{'date_accessed': '2023-10-17',
'source': 'OpenCode Public Disclosure'}],
'response': {'communication_strategy': 'Email notifications to affected '
'users, public disclosure',
'containment_measures': 'Notifying affected users, advising key '
'revocation and replacement',
'remediation_measures': 'Phasing out legacy system, advising '
'users to update dependent applications',
'third_party_assistance': 'Collaboration with Anthropic, OpenAI, '
'and Google'},
'stakeholder_advisories': 'Affected users advised to revoke and replace API '
'keys, update applications, and review usage logs.',
'title': 'OpenCode Security Breach Exposing Third-Party API Keys in Console '
'Workspaces',
'type': 'Data Breach',
'vulnerability_exploited': 'Legacy system with insufficient security controls'}