API Key Security Isn’t About Your Computer. It’s About Who Else Has a Copy.
TL;DR: Attackers reached a hosted service run by the AI coding tool OpenCode and took the AI provider keys users had saved there. Strangers then spent those users’ money — reported charges ran from a few hundred dollars to $1,700 overnight. OpenCode says 1.4% of that service’s users were affected, and that its open-source app was not involved. The useful lesson has nothing to do with OpenCode: api key security rests on one question almost nobody asks before pasting a key into a tool — who ends up holding a copy of it?
What happened
On 19 October, TechCrunch reported that attackers had broken into an older OpenCode system and taken API keys users had stored there. OpenCode — an open-source AI coding agent that has become a popular alternative to Claude Code and Cursor — disclosed it on Saturday and said the incident “remains ongoing”.
The scope, in OpenCode’s own words as reported by BleepingComputer: “a security breach last night related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users”. The earliest possible exposure it gave affected users was 17 October, 00:30 UTC. Only people who had linked an external provider were caught, and OpenCode told users that no email meant no impact. In practice:
- Unauthorised charges on users’ OpenAI, Anthropic and Google accounts — hundreds of dollars each, several over $1,000, one report of $1,700 overnight.
- Some users said Google suspended their projects, flagging “abusive activity consistent with hijacked resources”.
- Anthropic and Google blocked the exposed keys; OpenAI restored access and refunded the credits burned in the attack. OpenCode says refunds are underway.
- Co-founder Dax Raad drew a firm line around the product: “Note this is the OpenCode Console, not OpenCode itself, those keys never come to us.”
Two things are not established. Nobody has published how the attackers got in, so nobody can say which api key security failure caused this. And OpenCode’s “distillation attack” framing — training a cheaper model on another’s answers, which becomes an attack when the queries are unauthorised — was challenged in the 969-point Hacker News thread, where commenters noted that nothing public links the stolen keys to distillation. OpenCode’s own site linked no incident notice when we checked on 20 October.
Why API key security isn’t a developer problem
An API key is not a password. A password protects an account you log into. A key is closer to a company credit card with no limit printed on it: whatever holds it can spend, instantly, with no login, no prompt and no second factor. Nothing about it looks like money, which is the whole problem — and why api key security gets skipped.
If you build with AI tools you have almost certainly pasted one somewhere: an automation in Make or Zapier, a Bubble plugin, a custom GPT, a chatbot on your own site, whatever you built last month and forgot. Each is a copy of your card in somebody else’s database — which is why api key security is mostly a question about other people’s systems, not yours.
The clearest explanation came from the Hacker News thread, not a vendor: “If you use the hosted OpenCode Console and bring your own API keys, then they’d have your keys on their backend servers.” Another commenter asked what everyone was thinking — “isn’t OpenCode open source, why does it need credentials?” Both point at the same gap in api key security: “bring your own key” sounds like keeping control, and on a hosted service it means the opposite.
Raad’s reassurance was accurate and no help to the affected users. The keys genuinely never reach the open-source tool; they did reach the hosted one. One brand, two products, two different answers to “who has my key?” — and nothing in either name tells you which you are using. The promise attached to the product you read about may not cover the product you signed into.
Four API key security habits to set up today
Good api key security is not a product you buy. It is four habits, about ten minutes between them.
- List everywhere you have pasted a key. Api key security starts with an inventory, not a tool: builders, automations, browser extensions, that side project. If you cannot finish the list from memory, open each provider’s console and count the keys — one you cannot account for is the finding.
- Give every tool its own key. In Anthropic’s Console, keys are “tied to the Workspace they’re created in and cannot be moved between Workspaces”, so a workspace per tool lets you kill one key without breaking everything else.
- Put a monthly cap on each one. Anthropic sets spend limits per workspace, with optional email alerts at an amount you choose, and a workspace limit can only be lower than your organisation’s. This is the step that decides whether somebody else’s bad weekend costs you $168 or $1,700 — our guide to AI spending limits covers which vendors cap properly.
- Rotate at the provider, not in the tool. Deleting a key inside some app’s dashboard does not revoke it: TechCrunch’s instruction to affected users was to revoke and replace keys directly with each provider. In Anthropic’s Console you disable or delete the key itself, and deleting “is a permanent action and cannot be undone”.
If this one caught you, OpenCode said it emailed everyone affected and that refunds are in progress — but check your provider billing yourself rather than wait to be told.
Who should care (and who shouldn’t)
How much api key security work this needs depends on what you are building.
- Building a revenue app: api key security is part of your uptime story now — a suspended Google project takes the app down with it.
- An internal tool: do step 2 today. Shared team keys are how one leak becomes everyone’s problem.
- A website or landing page: low exposure — unless you added a chatbot. If you did, that chatbot has a key.
- Learning: the cheapest moment to build the habit. Separate key, small cap, first project.
- No idea yet: you are fine until you paste a key somewhere. Set the cap that day.
Our take
We would not switch tools over this. Judging a vendor on whether it has had an incident selects for the ones not yet caught; judging it on what it holds on your behalf is a question you can answer before signing up. OpenCode’s response reads as reasonable from outside — fast disclosure, direct emails, refunds, a straight answer on which product was involved — and any hosted service storing provider keys is one weekend from the same headline.
The default is what we would change: reaching for one key and pasting it everywhere is the habit that turns someone else’s breach into your bill. Note too that this is a different failure from AI accounts drained by malware on your own machine — there the fix is cleaning your computer, here your computer was never involved. Api key security and device security are two separate jobs.
Not sure which AI build tool fits you — and how much key-juggling it will involve? Take the 60-second Vibe Coding Tool Finder quiz →
Some links on this page are affiliate links. If you buy through them we may earn a commission at no extra cost to you.
FAQ
What is an API key, in plain English?
A long string of characters that lets one piece of software use another’s paid service on your behalf. Unlike a password there is no login screen and usually no second factor, so anything holding it can spend your money until you revoke it.
Was OpenCode itself hacked?
OpenCode says the breach hit OpenCode Console, its hosted service, and not the open-source app or command-line tool. Co-founder Dax Raad said of the open-source version: “those keys never come to us.” How the attackers got in has not been disclosed.
Does good api key security mean never storing keys in a tool?
No — most useful automation needs a stored key. It means storing a separate key for each tool, giving each one a spending cap, and revoking it at the provider rather than only deleting it inside the app.
