OpenCode disclosed a security breach on October 17. The company said an attacker accessed a legacy system and may have exposed API keys for OpenAI, Anthropic and Google. The breach affected 1.4 percent of Console users. OpenCode was decommissioning the system. Some users reported bills in the hundreds of dollars. The attackers used the stolen keys to query frontier models at someone else's expense.
The construction ERP calls OpenAI for invoice parsing. Atelier routes requests to nine model providers. The estimating tool calls Anthropic to score bid language. Each call requires an API key. I store those keys in environment variables and secret managers. The legacy system that OpenCode was shutting down stored user keys for Console workspaces. An attacker reached that system before the migration completed. The keys walked out.
The decommissioning was in progress
OpenCode told affected users the breach hit a legacy system it was decommissioning. The company has not published how long the system held keys after the replacement went live. A decommissioning process runs in stages. The new system goes up. Traffic moves over. The old system stays online while the last workspaces migrate. Keys sit in both places. The intruder found the old one. The email to users said the system was in the process of being decommissioned. The process was not done.
The key proves you paid
The breach exposed the ability to make large volumes of queries to frontier models on someone else's dime. A distillation attack pulls model outputs to train a competing model. The attacker needs access at scale. A stolen key provides that access. The victim pays for the queries. One OpenCode user reported over 1,700 dollars in unauthorized charges overnight. The key proved the victim paid. The key did not prove the queries were authorized.
The flight planner calls a weather API. The dating-profile tool runs inference on a Cloudflare Worker. Each call includes a bearer token or an API key. The token proves I have an account in good standing. It does not prove that the specific query came from me. The provider logs the request. The log shows my key. The log does not show who held the key when the call ran. If an attacker takes my key and runs 10,000 queries, the log attributes all 10,000 to me. The provider has no proof I did not make those calls.
The system was being shut down.
Suppose my keys sit in a secret manager. If I decommission the manager and stand up a new one, both will hold the keys until the migration finishes. The old manager will sit online with live credentials while I verify the new one works. The window where both exist is the window where an attacker can choose the weaker target. OpenCode was in that window. The keys sat in a legacy system that had not finished decommissioning. The attacker picked the legacy system.