OpenCode breach exposed AI provider keys: stop parking them

Your AI provider key is only as safe as the least careful tool you pasted it into. On October 17, OpenCode, the open-source AI coding agent, said on X that a breach tied to a "large scale distillation attack" hit 1.4% of OpenCode Console users. The exposed data: third-party provider API keys that users had saved in their Console workspaces. The OpenCode breach is a clean lesson in where AI keys should and should not live.

What actually happened

Per OpenCode's post and the email it sent to affected users, as reported by OfficeChai:

• The entry point. Unauthorized access to a legacy system OpenCode was in the process of shutting down.
• The exposure. Provider keys saved in Console workspaces, with OpenAI and Anthropic named. Reports also include Google keys.
• The scope. About 1.4% of Console users. If you got no email, OpenCode says you were not affected.
• The ask. Revoke and replace the keys in each provider's own dashboard, update any app that used them, and check recent usage for calls you did not make.
• The gaps. No post-mortem yet. No count of accounts, no timeline, no detail on how the attacker got in. OpenCode says it is working with Anthropic, OpenAI and Google.

"Distillation" here means using someone else's paid model access to harvest outputs at scale. Your key pays for the attacker's training data.

Why it matters for your business

The day before, Help Net Security reported on Bitsight research into MONST3R-AI, a tool sold on a criminal forum. Buyers load stolen OpenAI, Anthropic or Google keys, set a budget, and point an AI agent at targets. The key owner pays for the attack. Stolen AI keys are now a product with a resale market.

We just covered an infostealer that lifts AI keys off laptops. This is the other half of the problem: keys you handed to a vendor on purpose. Every dashboard that asks you to "bring your own key" becomes one more vault you do not control.

What we do instead:

• One key per tool. A key pasted into a coding agent console is that tool's key and nothing else. When the tool leaks, you revoke one key and nothing else breaks.
• Spend caps on every key. A hard monthly limit turns a stolen key from an open tab into a capped loss.
• Prefer tools that keep keys local. A CLI that reads from your OS keychain beats a hosted workspace that stores your key on its server.
• Revoke at the source. Deleting a key inside the tool does nothing if the tool's database is already copied. The provider console is the only kill switch.
• Watch usage daily. An alert on unusual token volume is the cheapest breach detector you can buy.

Sources: OpenCode on X, OfficeChai, Help Net Security.