{ "@context": "https://schema.org", "@type": "Report", "url": "https://optimuslabs.io/research/briefings/opencode-console-breach-provider-key-exposure", "identifier": "opencode-console-breach-provider-key-exposure", "headline": "OpenCode Console Breach: Your Provider Keys, Their Custody", "name": "OpenCode Console Breach: Your Provider Keys, Their Custody", "abstract": "An intruder reached a legacy OpenCode Console system and may have exposed provider API keys that teams saved there, for 1.4% of Console users. OpenCode has not said how.", "description": "Live incident, as of Oct 21, 2026. On the night of Oct 16, an intruder reached a legacy OpenCode Console system that the team was shutting down. Console is OpenCode's hosted gateway: teams save their own Anthropic, OpenAI and Google API keys there so members can use the models without seeing the keys. OpenCode describes the breach as related to a large scale distillation attack and says 1.4% of Console users may have had keys exposed. Anthropic revoked affected Claude keys, Google blocked affected Gemini keys, and OpenAI says it is refunding credits drawn in the attack. As of Oct 21, OpenCode has not published a root cause, entry point, dwell time or key count.", "datePublished": "2026-10-17", "dateModified": "2026-10-17", "inLanguage": "en", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "Optimus Labs · Civilizations", "url": "https://optimuslabs.io/research/briefings" }, "publisher": { "@type": "Organization", "name": "Optimus Labs", "url": "https://optimuslabs.io" }, "keywords": [ "OpenCode", "Anomaly", "Anthropic", "OpenAI", "Google", "Vendor breach", "AI Asset Supply Chain Security", "Cyber Hygiene", "agentic AI security", "AI agent supply chain" ], "about": [ { "@type": "Thing", "name": "OpenCode" }, { "@type": "Thing", "name": "Anomaly" }, { "@type": "Thing", "name": "Anthropic" }, { "@type": "Thing", "name": "OpenAI" }, { "@type": "Thing", "name": "Google" } ], "citation": [ { "@type": "CreativeWork", "name": "OpenCode statement on X, Oct 17", "url": "https://x.com/opencode/status/2111519637049319818" }, { "@type": "CreativeWork", "name": "Dax Raad: Console, not the app", "url": "https://x.com/thdxr/status/2111572618340188393" }, { "@type": "CreativeWork", "name": "Dax Raad: refunds", "url": "https://x.com/thdxr/status/2111608620441817449" }, { "@type": "CreativeWork", "name": "Dax Raad: 48 hours of attacks", "url": "https://x.com/thdxr/status/2111790511409258796" }, { "@type": "CreativeWork", "name": "Dax Raad: 26T token days", "url": "https://x.com/thdxr/status/2105448734272401788" }, { "@type": "CreativeWork", "name": "Lydia Hallie, Anthropic", "url": "https://x.com/lydiahallie/status/2111563956666110287" }, { "@type": "CreativeWork", "name": "Evan Otero, Google", "url": "https://x.com/EvanOtero/status/2111591525876474100" }, { "@type": "CreativeWork", "name": "Tibo Sottiaux, OpenAI", "url": "https://x.com/thsottiaux/status/2112034063934742720" }, { "@type": "CreativeWork", "name": "TechCrunch, Oct 19", "url": "https://techcrunch.com/2026/10/19/hackers-hit-ai-coding-tool-opencode-running-up-charges-on-users-ai-accounts/" }, { "@type": "CreativeWork", "name": "BleepingComputer, Oct 19", "url": "https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/" }, { "@type": "CreativeWork", "name": "The Hacker News, Oct 19", "url": "https://thehackernews.com/2026/10/opencode-console-breach-may-have.html" }, { "@type": "CreativeWork", "name": "The Latent, Oct 17", "url": "https://thelatent.co/models/opencode-says-breach-tied-to-distillation-attack-exposed-users-ai-provider-keys" }, { "@type": "CreativeWork", "name": "YC Root Access: Jay V interview", "url": "https://www.ycrootaccess.com/p/how-opencode-became-the-worlds-most" }, { "@type": "CreativeWork", "name": "Anthropic threat report, Sep 2026", "url": "https://www.anthropic.com/threat-intelligence-report-september-2026" }, { "@type": "CreativeWork", "name": "Anthropic: distillation defences, Oct 12", "url": "https://www.anthropic.com/research/distillation-defenses" }, { "@type": "CreativeWork", "name": "OWASP Top 10 for Agentic Applications 2026", "url": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/" }, { "@type": "CreativeWork", "name": "OWASP Top 10 for LLM Applications 2026", "url": "https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/" }, { "@type": "CreativeWork", "name": "OpenCode Zen docs", "url": "https://opencode.ai/docs/zen/" }, { "@type": "CreativeWork", "name": "GHSA-vxw4-wv6m-9hhh", "url": "https://github.com/anomalyco/opencode/security/advisories/GHSA-vxw4-wv6m-9hhh" }, { "@type": "CreativeWork", "name": "GHSA-c83v-7274-4vgp", "url": "https://github.com/advisories/GHSA-c83v-7274-4vgp" }, { "@type": "CreativeWork", "name": "OpenCode advisories", "url": "https://github.com/anomalyco/opencode/security" }, { "@type": "CreativeWork", "name": "OWASP Secrets Management Cheat Sheet", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html" }, { "@type": "CreativeWork", "name": "OWASP Key Management Cheat Sheet", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Key_Management_Cheat_Sheet.html" }, { "@type": "CreativeWork", "name": "OWASP Cryptographic Storage Cheat Sheet", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html" }, { "@type": "CreativeWork", "name": "NIST SP 800-57 Part 1 Rev. 5, Recommendation for Key Management", "url": "https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final" }, { "@type": "CreativeWork", "name": "Cloud Security Alliance research note, Oct 20", "url": "https://labs.cloudsecurityalliance.org/research/csa-research-note-opencode-console-provider-key-breach-20261/" } ], "encoding": [ { "@type": "MediaObject", "encodingFormat": "text/markdown", "contentUrl": "https://optimuslabs.io/research/briefings/opencode-console-breach-provider-key-exposure.md" }, { "@type": "MediaObject", "encodingFormat": "application/json", "contentUrl": "https://optimuslabs.io/research/briefings/opencode-console-breach-provider-key-exposure.json" } ], "additionalProperty": [ { "@type": "PropertyValue", "name": "severity", "value": "HIGH · LIVE INCIDENT · VENDOR BREACH" }, { "@type": "PropertyValue", "name": "blastRadius", "value": "Teams that saved their own provider keys in an OpenCode Console workspace. Keys used only in the local OpenCode app never reach OpenCode's servers, per co-founder Dax Raad. Some exposed keys were used to run up charges before the providers cut them off. User-reported charges run from about $200 to $1,700 on a single account, none verified by OpenCode." } ], "briefing": { "slug": "opencode-console-breach-provider-key-exposure", "number": 13, "title": "OpenCode Console Breach: Your Provider Keys, Their Custody", "dek": "An intruder reached a legacy OpenCode Console system and may have exposed provider API keys that teams saved there, for 1.4% of Console users. OpenCode has not said how.", "tldr": "Live incident as of Oct 21, 2026. OpenCode says a breach of its hosted Console, tied to a large scale distillation attack, may have exposed Anthropic, OpenAI and Google API keys for 1.4% of Console users. Revoke any key ever saved in Console at the provider. No root cause, entry point or key count has been published.", "date": "2026-10-17", "severity": "high", "severityLabel": "HIGH · LIVE INCIDENT · VENDOR BREACH", "types": [ "vendor-breach" ], "categories": [ "AI", "CH" ], "vendors": [ "OpenCode", "Anomaly", "Anthropic", "OpenAI", "Google" ], "featured": true, "liveIncident": { "asOf": "2026-10-21", "note": "Live incident, as of Oct 21, 2026. This page will be updated as OpenCode shares more." }, "blastRadius": "Teams that saved their own provider keys in an OpenCode Console workspace. Keys used only in the local OpenCode app [never reach OpenCode's servers](https://x.com/thdxr/status/2111572618340188393), per co-founder Dax Raad. Some exposed keys were used to run up charges before the providers cut them off. [User-reported charges](https://techcrunch.com/2026/10/19/hackers-hit-ai-coding-tool-opencode-running-up-charges-on-users-ai-accounts/) run from about $200 to $1,700 on a single account, none verified by OpenCode.", "summary": "Live incident, as of Oct 21, 2026. On the night of Oct 16, an intruder reached a legacy OpenCode Console system that the team was shutting down. Console is OpenCode's hosted gateway: teams save their own Anthropic, OpenAI and Google API keys there so members can use the models without seeing the keys. OpenCode describes the breach as related to a large scale distillation attack and says [1.4% of Console users](https://x.com/opencode/status/2111519637049319818) may have had keys exposed. Anthropic [revoked affected Claude keys](https://x.com/lydiahallie/status/2111563956666110287), Google [blocked affected Gemini keys](https://x.com/EvanOtero/status/2111591525876474100), and OpenAI says it is [refunding credits](https://x.com/thsottiaux/status/2112034063934742720) drawn in the attack. As of Oct 21, OpenCode has not published a root cause, entry point, dwell time or key count.", "affected": { "checks": [ "Did anyone on your team save an Anthropic, OpenAI, Google or other provider key in an OpenCode Console workspace?", "Did you receive OpenCode's email 'Action Required: Potential provider key breach' or the follow-up listing keys by last four characters?", "Does provider billing from Oct 16 on show models, volumes or regions you do not recognise?" ], "notAffected": [ "Keys used only in the local OpenCode app [are not stored on OpenCode's servers](https://x.com/thdxr/status/2111572618340188393), per Dax Raad. Rotate them anyway if you cannot confirm that." ], "note": "[Console only logs requests that pass through its own gateway](https://thehackernews.com/2026/10/opencode-console-breach-may-have.html), so a copied key used directly with the provider never shows up there. Empty Console logs do not clear you. The provider's billing page is the record that counts." }, "timeline": [ { "label": "Earliest possible exposure of stored keys", "date": "Oct 17, 00:30 UTC", "note": "Per OpenCode's follow-up email ([BleepingComputer](https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/))." }, { "label": "OpenCode posts on X", "date": "Oct 17", "note": "Breach \"[related to a large scale distillation attack](https://x.com/opencode/status/2111519637049319818)\", 1.4% of Console users." }, { "label": "OpenCode emails affected users", "date": "Oct 17", "note": "\"Action Required: Potential provider key breach\"." }, { "label": "Anthropic revokes keys", "date": "Oct 17", "note": "Lydia Hallie says Anthropic [revoked Claude API keys](https://x.com/lydiahallie/status/2111563956666110287) it believes were affected." }, { "label": "Google blocks keys", "date": "Oct 17", "note": "Evan Otero says Google [blocked exposed Gemini keys](https://x.com/EvanOtero/status/2111591525876474100); some users report project suspensions for \"abusive activity consistent with hijacked resources\"." }, { "label": "Dax Raad scopes the breach", "date": "Oct 17", "note": "\"[this is the OpenCode Console, not OpenCode itself, those keys never come to us](https://x.com/thdxr/status/2111572618340188393)\"." }, { "label": "Attacks continue; refunds underway", "date": "Oct 18", "note": "Dax Raad says attackers had been \"[non stop trying to attack our systems for the past 48 hours](https://x.com/thdxr/status/2111790511409258796)\"." }, { "label": "OpenAI refunds credits", "date": "Oct 19", "note": "Tibo Sottiaux says affected API customers are \"back in business\" and [credits drawn in the attack are being refunded](https://x.com/thsottiaux/status/2112034063934742720)." }, { "label": "Oct 21: No root cause, entry point, dwell time or key count published; incident described as ongoing", "date": "Oct 21" } ], "narrativeSections": [ { "heading": "Console holds your keys, not the app", "paragraphs": [ "Console is OpenCode's hosted gateway. A team saves its own provider keys in a workspace, and members use the models through Console without ever seeing the keys.", "That makes Console a third-party service in the path between a coding agent and the model, and it held live credentials for three labs at once. Keys used only in the local app [never reach OpenCode](https://x.com/thdxr/status/2111572618340188393), per Dax Raad." ] }, { "heading": "Why a coding tool got pulled into the distillation fight", "paragraphs": [ "Distillation means pulling a strong model's answers at scale to train a cheaper copy. Anthropic says distillers [mostly work through proxy networks of fake accounts](https://www.anthropic.com/threat-intelligence-report-september-2026) and \"will often use stolen API credentials belonging to legitimate companies or individuals\" (Anthropic threat report, Sep 2026).", "On Oct 12 Anthropic said [new defences](https://www.anthropic.com/research/distillation-defenses) cut the data distillers harvest by 90 to 99%, often ban distillation accounts within two hours, and stop API accounts created on or after Aug 31, 2026 from editing earlier context on its newest models.", "**Our read, not OpenCode's:** every one of those controls makes an established, paying customer's key worth more, because it comes with real billing, a normal usage history and, at Anthropic, an account older than Aug 31. A hosted gateway that holds such keys for three labs is the obvious place to look. OpenCode has not said how the breach and the distillation activity connect." ] }, { "heading": "Scale: why OpenCode is infrastructure now", "paragraphs": [ "By its own count OpenCode moves more open-model tokens than anyone: back-to-back [26 trillion-token days](https://x.com/thdxr/status/2105448734272401788) at the end of September (Dax Raad). That is up from [about 300 billion a day in January and 7 trillion in July](https://www.ycrootaccess.com/p/how-opencode-became-the-worlds-most) by co-founder Jay V's figures (YC Root Access), roughly 85 times in nine months.", "[16 million developers a month and about 215,000 GitHub stars](https://thelatent.co/models/opencode-says-breach-tied-to-distillation-attack-exposed-users-ai-provider-keys) (The Latent). [160,000 paying subscribers](https://www.ycrootaccess.com/p/how-opencode-became-the-worlds-most) as of July (YC Root Access). [More than 75 model providers](https://opencode.ai/docs/models/) behind one interface.", "Those totals are not all bring-your-own-key traffic of the kind that leaked; OpenCode also sells its own hosted models through Zen and Go, and it has not published how the volume splits. Still, a tool used this widely should be secured like infrastructure.", "OpenCode's own advisories include two January flaws that let a website run commands on a developer's machine ([CVE-2026-22812](https://github.com/anomalyco/opencode/security/advisories/GHSA-vxw4-wv6m-9hhh), high; [CVE-2026-22813](https://github.com/advisories/GHSA-c83v-7274-4vgp), critical) and a high-severity advisory in September ([GHSA-632h-h47v-g4x4](https://github.com/anomalyco/opencode/security)). The researcher who reported the first says their November email got no response; the advisory went public in January." ] }, { "heading": "How it maps to OWASP", "paragraphs": [ "Two lists from the OWASP GenAI Security Project cover this from different sides.", "[Top 10 for Agentic Applications 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/) covers the credentials agents run on: ASI03 Identity & Privilege Abuse (OWASP counts any authentication material, such as API keys, OAuth tokens and delegated sessions, as part of an agent's identity) and ASI04 Agentic Supply Chain Vulnerabilities (Console is a third-party service in the agents' path to the model, and it was compromised).", "[Top 10 for LLM Applications 2026](https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/) covers what was done with them: LLM02:2026 Sensitive Information Disclosure (credentials and API keys are named as protected information) and LLM06:2026 Unbounded Consumption (includes \"Model Extraction and Distillation Theft\" and stolen credentials used to run expensive computation).", "Neither list explains the break-in itself; if the entry point turns out to be an ordinary web or infrastructure flaw, it sits outside both.", "The two lists agree on the fix: short-lived, narrowly scoped credentials per agent (ASI03) and a hard per-key spending limit that stops inference rather than an alert after the bill (LLM06).", "*The OWASP GenAI Security Project does not endorse any product, service or tool, including Optimus Labs. We cite its lists to classify this incident.*" ] }, { "heading": "If you hold other people's keys", "lede": "Provider keys are crown jewels.", "paragraphs": [ "Any vendor that stores a customer's API key for them (a model gateway, an agent platform, an observability or CI tool) is one intrusion away from this same incident. OpenCode has not said how its stored keys were protected, so none of this is a finding about Console. It is the path we would expect a vendor to follow, drawn from [OWASP](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html) and [NIST key-management guidance](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final)." ], "practices": [ { "phase": "Hold less", "icon": "KeyRound", "title": "Store less", "body": "Use short-lived, scoped credentials or delegated access wherever a provider offers them. Many model providers still issue long-lived static keys, so a gateway often has to store them. Where the design allows, pass a key through for one request without saving it." }, { "phase": "At rest", "icon": "Lock", "title": "Use envelope encryption", "body": "A unique data key per credential, AES-256-GCM, with the data key wrapped by a master key in a KMS or HSM. OWASP says not to keep encryption keys next to the secrets they protect unless those keys are themselves encrypted." }, { "phase": "At rest", "icon": "Layers", "title": "Separate customers", "body": "One master key per customer, and bind each ciphertext to its customer and record so a copied blob will not decrypt in another row. Deleting a customer's key then makes their stored credentials unrecoverable." }, { "phase": "At rest", "icon": "EyeOff", "title": "Make stored keys write-only", "body": "No reveal button and no export. Show the last four characters and the date it was set. Never log a key: strip authorization headers from logs and error reports." }, { "phase": "In use", "icon": "Activity", "title": "Decrypt per use, and watch it", "body": "Decrypt only for the outbound call, wipe the plaintext from memory, and keep any cache short. Log every decrypt and alert on spikes, so a bulk pull stands out." }, { "phase": "Beyond the vault", "icon": "Archive", "title": "Retire systems completely", "body": "Before a system is decommissioned, move or delete the credentials it holds and confirm they are gone. Any system still holding live keys is still in scope." }, { "phase": "Beyond the vault", "icon": "Gauge", "title": "Give customers the brakes", "body": "Per-key spend caps that stop traffic, model and IP allowlists, last-used time and source for every key, and plain revoke steps for each provider." }, { "phase": "Beyond the vault", "icon": "Siren", "title": "Plan the breach before it happens", "body": "Keep a per-customer list of stored keys by last four characters, agree a revocation contact with each provider ahead of time, and tell customers in hours, not days. Anthropic and Google acted on Oct 17, within about a day of the first alert, and a pre-agreed route makes that routine." } ] }, { "heading": "What we still don't know", "paragraphs": [ "As of Oct 21, 2026:", "How the intruder reached the legacy system and when that access ended.", "How many users and keys the 1.4% represents.", "Whether stored keys were encrypted, and with what.", "How the key exposure connects to the distillation OpenCode described.", "Who is behind it. No one has been publicly named.", "Whether Anthropic and Google will refund charges the way OpenAI says it will, and on what terms." ] } ], "whatHappened": [ "An intruder reached a legacy Console system that was being decommissioned, on the night of Oct 16.", "Provider keys saved by 1.4% of Console users may have been exposed, from Oct 17 00:30 UTC at the earliest.", "Anthropic, Google and OpenAI acted on exposed keys within three days. OpenCode has not published how the intruder got in." ], "whyItMatters": [ "A hosted gateway that stores your keys makes the vendor part of your credential custody.", "Deleting a key in Console does not kill a copy; only revoking at the provider does. A Console budget cannot cap use that never passes through Console (The Hacker News).", "The entry point is unknown, so treat every key ever saved in Console as exposed until rotated." ], "whatToDo": [ "Revoke every key ever saved in a Console workspace at the provider, and confirm the old key no longer works.", "Check provider usage and billing from Oct 16 on, and keep records for refund claims.", "Review Console Logs, Audit and Controls, treat empty logs as inconclusive, and compare against provider billing.", "Move provider keys into a secrets manager you control, with one key per tool, scheduled rotation and a hard spending cap." ], "remediation": [ { "window": "Contain now · 0-24h", "actions": [ "Revoke every key ever saved in a Console workspace at the provider (Anthropic, OpenAI, Google and any others) and confirm the old key no longer works.", "Check provider usage and billing from Oct 16 on for models, volumes or regions you do not recognise. Keep records for refund claims.", "For charges you did not make on Google, contact Google Cloud Billing support from your account, as Google advises." ] }, { "window": "Investigate · 24-72h", "actions": [ "In the Console workspace, check Logs (every inference request, kept 30 days), Audit (every configuration change; look for changes nobody on your team made) and Controls (with no policies set, every member can use all enabled models with no spend limit).", "Treat empty logs as inconclusive, and compare them against provider billing." ] }, { "window": "Harden the agent surface", "actions": [ "Keep provider keys in a secrets manager you control (HashiCorp Vault, AWS Secrets Manager, GCP Secret Manager), not in a vendor's workspace.", "Route model calls through a gateway you run that pulls keys at runtime.", "Give each tool its own key, rotate on a schedule, and set a hard spending cap that stops traffic. Watch spend per key and alert on spikes.", "Ask any vendor that holds your keys how stored keys are encrypted and who holds the encryption keys, when stored credentials are deleted after a system is retired, whether you can see per key when it was last used and from where, and how fast and through which channel they will tell you about a breach." ] }, { "window": "For vendors that store customer credentials", "actions": [ "Apply the eight practices in 'If you hold other people's keys' to every stored credential.", "Verify that decommissioned systems no longer hold live keys." ] } ], "indicators": [ "Email subject: Action Required: Potential provider key breach", "Provider-side signal: Google project suspension for abusive activity consistent with hijacked resources", "Exposure window start: Oct 17 2026 00:30 UTC per OpenCode's follow-up email", "No CVE assigned to this incident" ], "sourcing": { "confirmed": [ "OpenCode's [public statement on X](https://x.com/opencode/status/2111519637049319818) and Dax Raad's posts.", "Statements on X from Anthropic, Google and OpenAI employees.", "Reporting by [TechCrunch](https://techcrunch.com/2026/10/19/hackers-hit-ai-coding-tool-opencode-running-up-charges-on-users-ai-accounts/), [BleepingComputer](https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/) and [The Hacker News](https://thehackernews.com/2026/10/opencode-console-breach-may-have.html)." ], "assessed": [ "The link between exposed keys and distillation is OpenCode's description and our read, not a disclosed finding.", "User-reported charges are unverified.", "The 1.4% is OpenCode's figure; no key count has been published." ] }, "vendorPerspective": { "heading": "How Optimus Labs finds OpenCode exposure in your tenant", "paragraphs": [ "The Optimus Labs sensor shows where OpenCode is installed: the CLI, the desktop app and IDE extensions, per device and per owner.", "It shows which devices have OpenCode's hosted providers linked (Console, Zen or Go). Those are the people most likely to have saved provider keys in a Console workspace.", "It shows which provider keys OpenCode holds on each device, as metadata only. We never read or store key values.", "Limit: keys pasted into the Console website live on OpenCode's servers, not on the device, so Optimus Labs cannot see them. Optimus Labs finds the people likely to be in scope, and they confirm against OpenCode's email and their Console workspace." ] }, "gallery": [ { "src": "https://id-preview--4c57b017-3c37-4684-8312-bfd671ff8872.lovable.app/__l5e/assets-v1/3102f061-6468-4f9d-8a53-08eb47284243/opencode-desktop-providers.png", "alt": "OpenCode Desktop providers settings page listing OpenCode Zen and OpenCode Go at the top, both marked Recommended, above Anthropic, GitHub Copilot and OpenAI.", "caption": "OpenCode Desktop v1.19.0: OpenCode (Zen) and OpenCode Go sit at the top of the providers list, both marked Recommended, above Anthropic, GitHub Copilot and OpenAI." }, { "src": "https://id-preview--4c57b017-3c37-4684-8312-bfd671ff8872.lovable.app/__l5e/assets-v1/59b9636c-a83c-4bdd-bec3-6344de663c7e/opencode-connect-zen.png", "alt": "OpenCode Desktop Connect Zen dialog asking for a single API key from opencode.ai/zen.", "caption": "Connecting Zen: one API key from opencode.ai/zen gives access to Claude, GPT, Gemini, GLM and more. Once a device has that link, it shows up in Optimus Labs." }, { "src": "https://id-preview--4c57b017-3c37-4684-8312-bfd671ff8872.lovable.app/__l5e/assets-v1/3e6fc428-ff3b-49ad-9965-d53a9b6b5be4/opencode-agent-inventory.png", "alt": "Optimus Labs Agent Inventory filtered to opencode, showing the OpenCode CLI and desktop app, both active and both marked Shadow.", "caption": "Inventory, Agents, searched for 'opencode': the CLI and the desktop app, both active and both marked Shadow. Demo tenant." }, { "src": "https://id-preview--4c57b017-3c37-4684-8312-bfd671ff8872.lovable.app/__l5e/assets-v1/7570a790-8509-4261-946d-73a929ad5f87/opencode-agent-detail.png", "alt": "Optimus Labs OpenCode agent page showing version, owners, sessions, token use, most used model and related agent assets.", "caption": "The OpenCode agent page: version, owners, sessions, token use, most used model and the 34 agent assets around it. Demo tenant; numbers are illustrative." }, { "src": "https://id-preview--4c57b017-3c37-4684-8312-bfd671ff8872.lovable.app/__l5e/assets-v1/e4284494-27d8-44ab-8488-b4516489a5ca/opencode-model-page.png", "alt": "Optimus Labs model page for space-bunny-free tracing the model back to OpenCode and a single user, with the user's name greyed out.", "caption": "The model view traces space-bunny-free back to OpenCode and the one person running it. It is a free model served through OpenCode Zen, so seeing it means that device is talking to OpenCode's hosted gateway. Demo tenant; name greyed out." } ], "image": "https://id-preview--4c57b017-3c37-4684-8312-bfd671ff8872.lovable.app/__l5e/assets-v1/08551bcc-7955-43a4-853a-8a8ed4f269e8/opencode-console-breach-trust-boundaries-oct21.png", "imageAlt": "OpenCode Console breach trust-boundary diagram, as of Oct 21, 2026, with four zones: the customer tenant, the OpenCode Console bring-your-own-key gateway, the model providers, and the threat actor. The entry point into Console is marked unknown. Provider keys stored in Console are shown as exposed, and distillation usage run on those keys is billed to the victims' provider accounts.", "sources": [ { "label": "OpenCode statement on X, Oct 17", "url": "https://x.com/opencode/status/2111519637049319818" }, { "label": "Dax Raad: Console, not the app", "url": "https://x.com/thdxr/status/2111572618340188393" }, { "label": "Dax Raad: refunds", "url": "https://x.com/thdxr/status/2111608620441817449" }, { "label": "Dax Raad: 48 hours of attacks", "url": "https://x.com/thdxr/status/2111790511409258796" }, { "label": "Dax Raad: 26T token days", "url": "https://x.com/thdxr/status/2105448734272401788" }, { "label": "Lydia Hallie, Anthropic", "url": "https://x.com/lydiahallie/status/2111563956666110287" }, { "label": "Evan Otero, Google", "url": "https://x.com/EvanOtero/status/2111591525876474100" }, { "label": "Tibo Sottiaux, OpenAI", "url": "https://x.com/thsottiaux/status/2112034063934742720" }, { "label": "TechCrunch, Oct 19", "url": "https://techcrunch.com/2026/10/19/hackers-hit-ai-coding-tool-opencode-running-up-charges-on-users-ai-accounts/" }, { "label": "BleepingComputer, Oct 19", "url": "https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/" }, { "label": "The Hacker News, Oct 19", "url": "https://thehackernews.com/2026/10/opencode-console-breach-may-have.html" }, { "label": "The Latent, Oct 17", "url": "https://thelatent.co/models/opencode-says-breach-tied-to-distillation-attack-exposed-users-ai-provider-keys" }, { "label": "YC Root Access: Jay V interview", "url": "https://www.ycrootaccess.com/p/how-opencode-became-the-worlds-most" }, { "label": "Anthropic threat report, Sep 2026", "url": "https://www.anthropic.com/threat-intelligence-report-september-2026" }, { "label": "Anthropic: distillation defences, Oct 12", "url": "https://www.anthropic.com/research/distillation-defenses" }, { "label": "OWASP Top 10 for Agentic Applications 2026", "url": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/" }, { "label": "OWASP Top 10 for LLM Applications 2026", "url": "https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/" }, { "label": "OpenCode Zen docs", "url": "https://opencode.ai/docs/zen/" }, { "label": "GHSA-vxw4-wv6m-9hhh", "url": "https://github.com/anomalyco/opencode/security/advisories/GHSA-vxw4-wv6m-9hhh" }, { "label": "GHSA-c83v-7274-4vgp", "url": "https://github.com/advisories/GHSA-c83v-7274-4vgp" }, { "label": "OpenCode advisories", "url": "https://github.com/anomalyco/opencode/security" }, { "label": "OWASP Secrets Management Cheat Sheet", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html" }, { "label": "OWASP Key Management Cheat Sheet", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Key_Management_Cheat_Sheet.html" }, { "label": "OWASP Cryptographic Storage Cheat Sheet", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html" }, { "label": "NIST SP 800-57 Part 1 Rev. 5, Recommendation for Key Management", "url": "https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final" }, { "label": "Cloud Security Alliance research note, Oct 20", "url": "https://labs.cloudsecurityalliance.org/research/csa-research-note-opencode-console-provider-key-breach-20261/" } ] } }