Key takeaways
- What happened: on 17 October 2026 OpenCode, the open-source AI coding agent, confirmed that someone got into a legacy system it was decommissioning. Third-party provider keys (OpenAI, Anthropic, Google and others) saved in Console workspaces may have been exposed for about 1.4% of Console users (OpenCode on X).
- Who must act: anyone who got OpenCode's "Action Required: Potential provider key breach" email. OpenCode says users without the email are not affected, but the investigation is still open, so rotating any key you saved in a Console workspace takes ten minutes and is worth it.
- Real money is at stake: users have reported unauthorised charges of about $400 on Anthropic and about €200 on Google, with one Google project suspended for abuse (Notebookcheck). At current exchange rates, $400 is over ₹30,000 — a month's cloud bill for many Indian startups.
- The fix is not just rotation. Give every tool its own key, its own project or workspace, and a hard monthly cap. All three big providers now support this.
- India angle: if a leaked key exposed customer data, not just spend, the CERT-In six-hour reporting rule may apply. Check with whoever owns compliance.
1. What OpenCode has said, and what it hasn't
OpenCode is a terminal-based coding agent (from Anomaly Innovations, the team formerly known as SST) that can talk to many model providers. Most people use it locally; the Console is its hosted service, where teams can save their own provider keys in a shared workspace.
Here is the confirmed picture as of 19 October:
| Question | Answer so far |
|---|---|
| What was accessed? | A legacy system OpenCode was in the process of shutting down |
| What may have leaked? | Provider API keys saved in Console workspaces |
| How many users? | About 1.4% of Console users; no absolute number given |
| Attacker's apparent goal | OpenCode calls it a "large scale distillation attack" — using stolen keys to pull huge volumes of model output, likely to train another model |
| Who is helping? | OpenCode says it is working with Anthropic, OpenAI and Google |
Local CLI keys (/connect, stored in auth.json on your machine) |
Not mentioned in the disclosure — neither confirmed affected nor cleared (DEV analysis) |
| Is it over? | No — OpenCode describes the incident as ongoing |
The "distillation" part matters for your bill. An attacker who wants training data does not make a few test calls. They hit the most expensive model, with long contexts, as fast as rate limits allow. That is why the reported charges arrived within hours, and why some users got usage alerts from OpenAI and Anthropic before OpenCode's email reached them.
2. If you got the email: the 30-minute response
Do these in order. Don't skip step 3 — teams often rotate a key and forget a CI job that still uses the old one.
- Revoke every provider key saved in the Console workspace from the provider's own dashboard (OpenAI → Project → API keys; Anthropic Console → API keys; Google AI Studio or Cloud Console → Credentials). For Gemini, create the replacement first, then disable the old key, so you don't cause an outage.
- Create new keys with the narrowest scope available (see section 3).
- Update everything that used the old key: apps,
.envfiles on servers, GitHub/GitLab CI secrets, n8n or Zapier connections, and the OpenCode workspace itself. - Prove the old key is dead. A request to the provider's models endpoint with the old key should return HTTP 401.
- Review usage back to at least 16 October. Look for unfamiliar models, activity at hours your team is offline, and spikes in output tokens.
- If you see fraudulent charges, open a billing ticket with the provider and quote the OpenCode incident. Outcomes aren't guaranteed, but a fast, documented report helps.
If you did not get the email but saved keys in a Console workspace, rotating them anyway is cheap insurance. If you only use the CLI locally, there is no confirmed exposure. It's still a good week to check that ~/.local/share/opencode/auth.json isn't sitting in a synced folder or a dotfiles repo.
3. The real lesson: one key, one tool, one cap
The breach isn't really about OpenCode. Every AI tool you paste a key into — coding agents, browser extensions, no-code automation, "bring your own key" SaaS — is another place that key can leak. You can't avoid that, so plan for it: assume any key you hand to a third party will leak eventually, and make sure that costs very little when it does.
The three big providers now offer the controls to do this:
| Control | OpenAI | Anthropic | Google (Gemini / Cloud) |
|---|---|---|---|
| Isolation unit | Projects | Workspaces (up to 100 per org by default) | Projects |
| Scoped keys | Project and service-account keys that only work inside one project | Workspace-scoped keys that only reach that workspace | API keys restricted by API, IP or app; per-person and per-app keys recommended |
| Spend cap | Monthly project spend limit with alerts; can be enforced as a hard stop | Monthly spend limit and alert thresholds per workspace | Budgets and alerts in Cloud Billing; quotas per API |
| Rate limit per scope | Per-model limits per project | Per-model RPM and token limits per workspace | Per-API quotas |
| Least-privilege permissions | Restricted / read-only key permissions per endpoint | Admin-managed; keys scoped to workspace | API restrictions; avoid broad IAM roles on Gemini-bound service accounts |
| Docs | OpenAI cost controls | Anthropic workspaces | Google API key best practices |
A practical layout for a small Indian product team:
prod-backend— the key your production server uses. It lives only in your secrets manager or server environment, never on a laptop. It gets the highest cap.dev-agents— one per developer for coding agents such as OpenCode, Claude Code, Cursor or Aider. Cap it at something like $50 (roughly ₹4,000–4,500) a month. If it leaks, the most you lose is one person's monthly allowance.automation— for n8n, Make or Zapier flows, with only the models those flows need.experiments— a throwaway project with a very low cap, for trying new tools you don't trust yet.
Set an alert at 50% and a hard stop at 100% on every non-production scope. A coding agent stopping halfway through a refactor is annoying. A ₹30,000 surprise is worse.
4. Hygiene that would have limited the damage
None of this needs new software.
- Prefer a gateway you control. If several tools need model access, put a small proxy (LiteLLM or your own API gateway) in front of the providers. Tools get gateway keys you can revoke in one place. The real provider key never leaves your server.
- Delete keys you don't use. Google's guidance says it plainly: unused keys are attack surface. Do a quarterly sweep and delete anything that hasn't been used in 90 days.
- Turn on secret scanning in GitHub or GitLab, so a key committed by mistake is flagged within minutes.
- Sandbox agents. Coding agents run shell commands with your user's permissions. Running them in a dev container or VM limits what a bad prompt — or a bad dependency — can reach, including the
.envfiles on your laptop. - Watch usage daily during incidents. Most providers can email or webhook you on a threshold. Send it to the team's shared channel, not one founder's inbox.
5. The India angle: spend, compliance, and clients
Spend. Most Indian startups pay AI providers by international card in dollars, so a leak hits the forex bill as well. Hard caps matter more here than for a US team on monthly invoices: the card gets charged before anyone notices, and a chargeback on a foreign SaaS charge is slow.
Compliance. The CERT-In directions of April 2022 require organisations in India to report listed cyber incidents — including unauthorised access to IT systems or data — within six hours of noticing them. A leaked key that only ran up model spend may not qualify. A key that could read customer prompts, files or fine-tuning data is closer to the line. Under the DPDP framework, your clients will also expect to hear from you if their data might have been exposed. We're not lawyers: write down what the key could reach, then decide with your compliance owner.
Clients. If you're an agency or IT services firm and your developers used client-owned keys in an AI tool, tell the client today. Rotate together, and agree that client keys live in client-owned projects with their own caps. That protects both sides the next time a tool gets breached.
AI coding agents are now standard equipment for Indian dev teams, and this won't be the last tool to leak keys. The teams that come out of it fine are the ones where a stolen key is worth very little.
Want AI agents and automation set up with proper key isolation, spend caps and monitoring from day one? See our AI automation & development service, or check your domain's email security with the free DNS & email security check.