OpenCode has disclosed a security breach affecting 1.4% of its Console users, warning that third-party API keys stored in affected workspaces may have been exposed. In a statement issued on October 17, the company linked the incident to a large-scale distillation attack and said it was working with Anthropic, OpenAI and Google in response.
The affected group was limited to some Console users who had connected external providers. OpenCode said it contacted all affected users by email and stated that users who did not receive a notification were not impacted. The 1.4% figure applies to Console users rather than OpenCode’s entire user base.
FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals
Legacy System Access Put API Keys at Risk
OpenCode said it detected unauthorised access to a legacy system that was already scheduled to be shut down.
Third-party provider credentials stored in affected workspaces, including API keys associated with OpenAI and Anthropic, may have been exposed. The company advised affected users to revoke and replace the credentials through the relevant provider dashboards, update any applications that rely on those keys and review recent account activity for signs of unexpected use.
The company’s notice described the incident as a possible exposure rather than confirming that every affected API key had been stolen or misused.
OpenCode has not disclosed how the attackers gained access to the system, how long the intrusion lasted or how many credentials may have been affected.
Company Links Incident to Distillation Activity
OpenCode said the breach was connected to a large-scale distillation attack, though it has not released technical evidence explaining how the two events were linked.
Distillation can involve using the outputs of one artificial intelligence model to train or improve another model. In an unauthorised campaign, large volumes of responses may be collected without the original provider’s permission.
OpenCode has not said whether any exposed credentials were used to generate such requests. Its public disclosure establishes a reported connection between the breach and the distillation activity, but does not provide a complete account of the attack.
The company has also not identified an attacker or disclosed any confirmed financial loss linked to the incident.
Affected Users Told to Revoke and Replace Keys
OpenCode advised users who received breach notifications to replace their third-party API keys immediately and update every application that depends on them.
Users were also asked to review recent provider activity and billing records for any transactions or requests that may require investigation.
OpenCode said the incident remained under investigation when it issued its statement and that it could not provide further details at that stage.
A fuller technical account would be needed to establish the initial point of access, the complete scope of the credential exposure and whether any affected API keys were subsequently used without authorisation.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
