Unauthorized access to an old system, affecting 1.4% of Console users
Open-source AI coding tool "OpenCode" disclosed on X on Oct. 17 (Oct. 18 Japan time) that external API keys registered by users with its paid management service, "OpenCode Console," may have leaked. Console is a service in which users deposit their API keys from OpenAI, Anthropic and Google and call each company's AI models through OpenCode. According to the company, an old system that was being retired was accessed without authorization on the night of Oct. 16, affecting 1.4% of Console users. Those affected were some of the users who had connected external AI services; the company notified them by email and said users who did not receive an email were not affected.
OpenCode is an AI coding tool that lets users instruct AI to write code or fix bugs, and it can switch between AI models from multiple companies. Its command-line and desktop apps for computers store API keys on the user's own device. Co-founder Dax Raad said the problem was limited to Console and that keys on devices never reach the company.
Described as linked to a large-scale distillation attack
OpenCode described the unauthorized access as linked to a large-scale distillation attack. Distillation is a technique of collecting large numbers of answers from a high-performing AI model and using them to train a smaller, cheaper model. The technique itself is common, but sending large volumes of queries without permission using other people's keys or fake accounts is considered an attack. Raad posted on Oct. 18 that the attackers had been using AI agents to attack the company's systems continuously for 48 hours.
However, the company has not disclosed how the intrusion occurred, how many keys were stored in the system, or how many people the 1.4% represents. It has not identified the attackers either. According to Raad, early in the investigation, AI models refused requests to analyze the attack because of safety restrictions, stalling the work. The situation stabilized after the company began using "Daybreak," OpenAI's model for cyber defense, he said.
Unexplained charges from several hundred dollars to $1,700
Users reported a string of bills for API usage they had not used. According to user accounts compiled by U.S.-based The Hacker News, one user said they did not recognize $281 of usage on OpenAI and $168 on Anthropic, and another estimated their losses at $1,700. On Reddit, there were also reports of charges of $400 on Anthropic and about 200 euros on Google, with a Google project suspended over fraudulent activity consistent with hijacked compute resources. All of these are users' own accounts, and OpenCode has not said it confirmed fraudulent use.
| User-reported item | Amount |
|---|---|
| OpenAI usage (first user) | $281 |
| Anthropic usage (first user) | $168 |
| Total losses (second user) | $1,700 |
| Anthropic usage (Reddit) | $400 |
| Google usage (Reddit) | About 200 euros |
Guidance on revoking keys and compensation
OpenCode asked affected users to revoke and regenerate their API keys in each company's dashboard and to update every app that uses the old keys. Because anyone who holds an API key can send requests that incur charges, deleting the key from Console does not revoke it. The Hacker News also recommends checking charges since Oct. 16 and setting usage spending limits. The company mentioned the possibility of compensation and said it is working with OpenAI, Anthropic and Google on the response. The three companies have not issued official statements on the matter.
AI developers are increasingly wary of distillation by other companies. In September, Anthropic disclosed distillation attempts using fake accounts and harvested API keys. AI API keys are bought and sold on black markets and abused to use AI at other people's expense.
