OpenCode Console intrusion threatens linked AI provider credentials

The breach at OpenCode Console highlights the persistent risks associated with managing access to third-party AI services. API keys, which allow applications to authenticate requests and incur charges, were potentially compromised. This creates a financial risk for affected users, as unauthorized parties could submit requests to AI models, potentially leading to unexpected billing without direct access to user passwords.

The company described the incident as connected to a large-scale distillation attack, though the full sequence of events remains unestablished. Distillation generally involves using outputs from an existing AI model to help train or improve another model, which can generate substantial volumes of automated requests. The public disclosure has not clarified whether this activity preceded or followed the credential exposure.

Security specialists have urged affected organizations to proactively replace all potentially exposed credentials rather than relying solely on the absence of suspicious activity. This recommendation underscores that even without immediate signs of misuse, the risk remains. Advice extends to examining provider usage and billing records from October 16 for unexpected requests, unfamiliar models, or unexplained charges, including those from shared workspace configurations.