DEV Community

Anoymask
Anoymask

Posted on

OpenCode Console Compromise: Potential Exposure of External AI Provider API Keys and Unauthorized Charge Reports

#security #threatintel

1. Basic Information

2. Summary

OpenCode has notified 1.4% of all Console users that API keys for integrated external AI providers may have been exposed. While some users have reported unauthorized charges and Google Cloud project suspensions, this does not mean that unauthorized use has been confirmed for the API keys of all notified users.

3. Attack Flow

Potential API Key Exposure and Reports of Unauthorized Use

  1. According to the published notification for users, the affected legacy Console system stored API keys for external providers. However, details regarding the initial intrusion method and whether individual API keys were actually stolen remain unannounced.
  2. According to the reporting, a maintainer described an attack aimed at large-scale model distillation, and co-founder Dax Raad said the attacks using AI agents lasted at least 48 hours. This does not establish how the AI agents were used or whether model training succeeded.
  3. Some users reported unauthorized charges and the suspension of Google Cloud projects. The public notification states that it cannot confirm whether individual API keys were used without authorization, so the scope of the operator notification and the harm reported by users must be considered separately.

4. Attacker Position and Prerequisites

  • An attacker who can reach external provider API keys from the OpenCode Console system. The specific initial intrusion path has not been disclosed.

5. Visibility for Victims and Administrators

Victim Side

  • Appears as an impact notification email from OpenCode, unfamiliar API usage charges, or the suspension of a Google Cloud project.

Administrator Side

  • May appear as a sudden spike in provider-side usage logs, requests involving unfamiliar models, regions, or User-Agent strings, quota exhaustion, or changes in the source IP addresses using the API keys.

6. Success and Failure Conditions

Success Conditions

  • External provider API keys are linked to the OpenCode Console, and the user falls within the affected scope (1.4% of all Console users).
  • The exposed API keys remain valid, and the permission scopes and quota settings on the provider side permit unauthorized external requests.

Failure Conditions and Defensive Branches

  • Prompt API key revocation can limit ongoing abuse. Where supported by the provider, short validity periods, strict quotas, source restrictions, and automatic suspension on anomalous usage can provide additional controls.
  • However, merely rotating API keys does not resolve already incurred unauthorized charges, verification of generated content, or lifting project suspensions, which requires investigation requests to each provider.

7. What Happens Upon Success

  • Unauthorized use of external AI APIs and high usage charges.
  • Disruption of development and operations due to quota exhaustion or cloud project suspension.
  • Potential expansion of impact to related other APIs and cloud resources depending on the permission scopes granted to the API keys.

8. Observable Logs

The following are candidate investigation items. Availability depends on the product, permissions, log settings, and retention periods; the absence of records does not prove the absence of a breach.

  • Email: Check for impact notification emails from OpenCode and billing/unauthorized use notifications from each AI provider.
  • Proxy/SWG/DNS: Inference: Requests using API keys stolen by external attackers may not pass through internal proxies. Correlate internal communication records with usage logs and audit records available on the provider side.
  • Endpoint/EDR: Inference: No malware infection on endpoints has been confirmed. Check if the same API keys remain in local configuration files or shell history.
  • Identity/IdP: Check history for API key creation, viewing, and deletion, service accounts, and project member changes.
  • SaaS/Cloud: Check API usage volume, models used, consumed token counts, source information, quota exhaustion, billing anomalies, and project suspension events in Anthropic, OpenAI, and Google Cloud.
  • Network: Check if the volume, destinations, and timing of API requests deviate from the normal baseline.

9. Scope of Success Confirmation

API Key Exposure Potential and User Reports

  • Scope: Notifications covered 1.4% of all Console users: a subset of users who had integrated external providers. This does not indicate the proportion relative to the total number of registered API keys, nor does it mean that all notified users experienced harm from unauthorized use.
  • Basis: Unconfirmed: The published OpenCode notification indicates that API keys may have been exposed, but states that it cannot confirm whether individual API keys were actually used without authorization. Although some users have reported unauthorized charges and project suspensions, this does not confirm the successful theft and abuse of keys for all notified users.

Evaluation Criteria in Your Organization

  • Separate contact, execution, information retrieval, and subsequent compromise; do not infer unconfirmed success from a single alert.

10. Investigation Playbook

  • Investigation Starting Point: Start from notifications from OpenCode, sudden spikes in API usage, billing anomalies, or cloud project suspension notices.
  • Initial Verification: Check for the presence of impact notices, integrated providers, API key IDs and permission scopes, last rotation date, and the time anomalies were first observed.
  • Endpoint/Server Investigation: Check if identical API keys are redundantly stored in local configuration files, CI/CD secrets, or shell history.
  • Authentication/Cloud Investigation: Promptly revoke and reissue the affected API keys while exporting and preserving audit logs, usage history, and billing data from each provider.
  • Subsequent Actions: Expand the investigation scope to unfamiliar request prompts and input/output data, usage of other APIs within the same project, and reuse of the same keys elsewhere.
  • Containment: Revoke the affected API keys and check/apply available quota limits, source restrictions, and spending caps on the provider side. Note that simple budget alerts (notifications only) must be distinguished from spending caps that actually block requests (hard limits), and requests for investigation regarding unauthorized charges or project suspensions must be made to the provider.
  • Judgment Categories: Separate API key exposure potential, unauthorized API calls, charges incurred, access to data, and project suspensions into distinct stages.

11. Defense and Detection Ideas

  • Single Event: Detect large token consumption requests from unusual sources or unused models, or sudden attainment of quota limits.
  • Time-Series Correlation: Correlate key integration in OpenCode -> sudden spike in abnormal API requests -> sudden increase in billing amounts -> unauthorized use notifications/project suspensions from providers.
  • Threat Hunting: Search for unfamiliar usage records on the same API key IDs, projects, and service accounts since October 17, 2026, 00:30 UTC.
  • Log Limitations: The BleepingComputer article cites primary notifications, but a detailed post-mortem report by OpenCode has not been published, leaving initial intrusion vectors and full request contents unconfirmed.
  • Priority Countermeasures: Prioritize immediate API key rotation, enforcement of least-privilege scopes, preservation of provider usage logs, and configuration of quotas and spending caps.

12. Facts / Inference / Hypothesis

Facts

  • According to management announcements cited by BleepingComputer, notifications covered 1.4% of all Console users, specifically a subset who had integrated external providers.
  • Anthropic, OpenAI, and Google are listed as integrated providers. Additionally, a notification image published by a user lists October 17, 2026, 00:30 UTC as the earliest possible exposure time for API keys stored on the legacy Console system.
  • A maintainer described the activity as a large-scale distillation attack, and co-founder Dax Raad said the attacks using AI agents continued for at least 48 hours.
  • Some users reported unauthorized charges ranging from hundreds to 1,700 USD or Google Cloud project suspensions due to unauthorized resource usage.
  • The published notifications state that there is no sign of data other than API keys being exposed, while explaining that it cannot be confirmed whether individual API keys were actually used without authorization. Detailed initial intrusion paths remain undisclosed.

Inference

  • Affected API keys should be promptly revoked and reissued, while provider-side usage logs, quota settings, models, and request patterns are preserved in parallel. Additionally, financial damage must be distinguished from the presence of unauthorized access to internal organization data.

Hypothesis

No additional hypotheses. Unverified items are listed under "Unknowns and Additional Investigations".

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1528 Steal Application Access Token medium Potential exposure of external AI API credentials was reported. This mapping does not equate API keys with OAuth tokens; the specific collection mechanism and successful theft of individual keys remain unconfirmed. Definition
T1496.004 Resource Hijacking: Cloud Service Hijacking medium Unauthorized use of AI APIs and charges incurred through stolen API credentials have been reported. This maps to abuse of LLM services; the contents of individual requests and successful model training remain unconfirmed. Definition

14. Unknowns and Additional Investigations

  • The initial intrusion method into OpenCode, the storage and encryption status of API keys in the legacy system, the total volume and specific objectives of attack requests, and whether existing input data could be accessed via the API remain unknown.

15. Impact on SOCs and Organizations

When operating environments that consolidate personal or organizational external provider API keys into the web console of AI coding agents, agent-side compromises must be treated as cloud and API credential leakage incidents, requiring cross-checks of quotas, billing, and project states.

16. Summary by Role

  • For SOCs: Correlate OpenCode notification targets, sudden spikes in provider API usage, unknown models or request sources, and quota/billing anomalies.
  • For Administrators: Immediately revoke and reissue affected API keys, and verify quota limits, spending restrictions, and project permission settings for each provider.
  • For Users: If you receive an impact notification, immediately delete and reissue registered API keys, and report any suspicious charges to your provider and organization administrator.

Top comments (0)