Executive Summary
One detail separates the affected users from everyone else. The keys that leaked were the ones a team saved into a hosted workspace so that no individual engineer had to hold them, and OpenCode puts that group at 1.4 percent of Console users. Keys pasted into the local command line tool stayed on the machine they were typed into.
The verdict is that centralizing credentials inside a vendor product buys team convenience and inherits a secret store’s threat model, and a coding assistant rarely gets reviewed like a secret store. Rotation is the right first move and the least useful one, because it stops new spend without restoring suspended projects or the two days already spent. Affected teams should audit provider usage from 17 October forward, apply the spend caps they should already have, and assume the key was used rather than merely exposed.
The breach did not happen on a developer laptop. It happened in the place a team puts its key so that nobody on the team has to hold it. OpenCode told users on 17 October that an attacker reached a legacy system it was decommissioning, and that third party provider keys saved in Console workspaces may have been exposed. Some users learned it from their provider invoice instead. One reported more than $1,700 in unauthorized charges overnight, as BleepingComputer reported.
Console is the hosted side of an open source coding agent that fronts dozens of model providers. A workspace stores an OpenAI, Anthropic or Google key so teammates can call a model without seeing the credential. That is the feature. It is also one credential with an entire team behind it. The Hacker News reported that the intruder reached the system on the night of 16 October.
The safe practice is the one that concentrates the risk
Storing the key centrally is not sloppiness. It is the only way to give eight engineers access to a model without handing out eight copies of a credential, and it is what every secret store does. The catch is that the service holding the keys inherits a secret store’s security bar. OpenCode runs an agent. The keys sat on a legacy system being taken out of service on the same estate.
OpenCode has not said how the attacker got in, how many keys that system held, or how long access lasted. The notice puts the earliest possible exposure at 00:30 UTC on 17 October and says no other data appears to have been exposed. The important word is appears. That is the company’s assessment rather than a finding, and users reporting charges on their own provider accounts is the reason to read it carefully.
Rotation stops the meter, it does not undo the week
Rotating a key ends new spend. It does not restore a suspended Google Cloud project, unsend two days of queries, or put back a workspace somebody else cleaned out. Anthropic and Google blocked keys they believed were exposed. OpenAI worked with OpenCode to restore access and refunded API customers for credits burned in the attack, TechCrunch reported. Three providers, three recovery paths, and every affected user lived with the one their provider picked.
The control that would have contained this is scope, not rotation. A token issued per workspace, capped by budget and model, turns a stolen credential into an afternoon of spend instead of an overnight one. The providers expose project scoping and budget limits, and most teams never set them for a code assistant, because nobody files a coding tool under production infrastructure. That filing is the fix.
The defenders’ own model refused to help
The detail worth keeping came from co-founder Dax Raad. Attackers had been working the systems for at least 48 hours using AI agents, he said, and were still trying on 18 October. When his team pointed its own models at the investigation, they began refusing requests under built-in safety guardrails. OpenCode said the situation stabilized after it was cleared to run a security specific model for defensive work.
Put that in the incident response document. If the playbook assumes a general assistant sits in the loop, the assistant can stop answering halfway through, and the approval that unblocks it arrives on somebody else’s timetable.
OpenCode says it cannot share more while it works with Anthropic, OpenAI and Google. So the open questions behind the API key breach are how the legacy system was reachable from outside, what else lived on it, and whether the retries Raad described on 18 October came from the same actor.
Three questions about your own stack. Which of your AI credentials live inside a vendor hosted product rather than on your own estate. Does each one carry a spend cap and a project scope, or is it a raw key with the whole account behind it. And if the assistant your security team relies on refused a request mid incident, what would they reach for instead.
Related reading. Nine models tried to break Perplexity’s agent sandbox is the isolation version of the same problem. India rated AI agents critical and its own fix list is a secrets audit covers the control list, and a stolen app secret reached 162 tenants is the same failure inside a SaaS platform.
Get the next one before it is old news
Independent analysis of cloud-native infrastructure, Kubernetes and data center economics. No vendor spin.
[…] reading. We looked at what happens after a credential walks out of a shared workspace, and at why rotating one secret after a supply chain compromise is not a […]