OpenCode Console Breach: Your Provider Keys, Their Custody

Console holds your keys, not the app

• Console is OpenCode's hosted gateway. A team saves its own provider keys in a workspace, and members use the models through Console without ever seeing the keys.
• That makes Console a third-party service in the path between a coding agent and the model, and it held live credentials for three labs at once. Keys used only in the local app never reach OpenCode, per Dax Raad.

Why a coding tool got pulled into the distillation fight

• Distillation means pulling a strong model's answers at scale to train a cheaper copy. Anthropic says distillers mostly work through proxy networks of fake accounts and "will often use stolen API credentials belonging to legitimate companies or individuals" (Anthropic threat report, Sep 2026).
• On Oct 12 Anthropic said new defences cut the data distillers harvest by 90 to 99%, often ban distillation accounts within two hours, and stop API accounts created on or after Aug 31, 2026 from editing earlier context on its newest models.
• Our read, not OpenCode's: every one of those controls makes an established, paying customer's key worth more, because it comes with real billing, a normal usage history and, at Anthropic, an account older than Aug 31. A hosted gateway that holds such keys for three labs is the obvious place to look. OpenCode has not said how the breach and the distillation activity connect.

Scale: why OpenCode is infrastructure now

• By its own count OpenCode moves more open-model tokens than anyone: back-to-back 26 trillion-token days at the end of September (Dax Raad). That is up from about 300 billion a day in January and 7 trillion in July by co-founder Jay V's figures (YC Root Access), roughly 85 times in nine months.
• 16 million developers a month and about 215,000 GitHub stars (The Latent). 160,000 paying subscribers as of July (YC Root Access). More than 75 model providers behind one interface.
• Those totals are not all bring-your-own-key traffic of the kind that leaked; OpenCode also sells its own hosted models through Zen and Go, and it has not published how the volume splits. Still, a tool used this widely should be secured like infrastructure.
• OpenCode's own advisories include two January flaws that let a website run commands on a developer's machine (CVE-2026-22812, high; CVE-2026-22813, critical) and a high-severity advisory in September (GHSA-632h-h47v-g4x4). The researcher who reported the first says their November email got no response; the advisory went public in January.

How it maps to OWASP

• Two lists from the OWASP GenAI Security Project cover this from different sides.
• Top 10 for Agentic Applications 2026 covers the credentials agents run on: ASI03 Identity & Privilege Abuse (OWASP counts any authentication material, such as API keys, OAuth tokens and delegated sessions, as part of an agent's identity) and ASI04 Agentic Supply Chain Vulnerabilities (Console is a third-party service in the agents' path to the model, and it was compromised).
• Top 10 for LLM Applications 2026 covers what was done with them: LLM02:2026 Sensitive Information Disclosure (credentials and API keys are named as protected information) and LLM06:2026 Unbounded Consumption (includes "Model Extraction and Distillation Theft" and stolen credentials used to run expensive computation).
• Neither list explains the break-in itself; if the entry point turns out to be an ordinary web or infrastructure flaw, it sits outside both.
• The two lists agree on the fix: short-lived, narrowly scoped credentials per agent (ASI03) and a hard per-key spending limit that stops inference rather than an alert after the bill (LLM06).
• The OWASP GenAI Security Project does not endorse any product, service or tool, including Optimus Labs. We cite its lists to classify this incident.

If you hold other people's keys

Provider keys are crown jewels.

Any vendor that stores a customer's API key for them (a model gateway, an agent platform, an observability or CI tool) is one intrusion away from this same incident. OpenCode has not said how its stored keys were protected, so none of this is a finding about Console. It is the path we would expect a vendor to follow, drawn from OWASP and NIST key-management guidance.

What we still don't know

• As of Oct 21, 2026:
• How the intruder reached the legacy system and when that access ended.
• How many users and keys the 1.4% represents.
• Whether stored keys were encrypted, and with what.
• How the key exposure connects to the distillation OpenCode described.
• Who is behind it. No one has been publicly named.
• Whether Anthropic and Google will refund charges the way OpenAI says it will, and on what terms.

Remediation

Indicators

Sources

Sourcing & confidence