OpenCode disclosed a breach of its Console hosting platform on October 17: unauthorized access to “a legacy system that we were in the process of decommissioning” reached third-party provider API keys stored by Console users, and attackers spent the stolen keys running queries against frontier models - what OpenCode calls “a large scale distillation attack.” About 1.4% of OpenCode Console users were affected, “a subset of users who had external providers linked,” all emailed by morning. OpenAI, Anthropic, and Google (via the remediation statement) are the providers named. The affected users’ bills are real: drained provider balances, with some users reporting hundreds of dollars run up under their keys.
View this post on X →
What the chain looked like
The disclosure email and the post give five facts, enough to draw the whole chain: a legacy system was still reachable; it could see keys saved in Console workspaces; the keys were harvested; the attackers ran repeated queries against high-end models; and the cost landed on the users whose keys were spent.
The label OpenCode chose, distillation, is the part worth naming precisely. Distillation is one model learning from another’s outputs; a distillation attack harvests high-quality responses at scale. Anthropic detailed the technique class in February 2026 and accused Alibaba of the largest such campaign in June: 28.8 million fraudulent requests aimed at extracting Claude-class intelligence into competitors’ models. This breach is the same class of goal with a different wallet: instead of the attacker’s computing, the victims’ paid keys computed the harvest.
The same agent, two deployment shapes: a local install keeps keys in env vars with the blast radius of one machine; the hosted gateway centralizes linked provider keys behind shared infrastructure. The breach hit the gateway side. (Figure: tokenstead.ai)
The gateway is the attack surface
The detail that makes this a Tokenstead story: Console is the hosted layer of a local-first tool. The free tier that this site covered in the GLM 5.3 Flash piece - glm-5.3-flash-free, deepseek-v4.1-flash-free, beam-free - is served through that gateway. A user picks “free” in the terminal, and their provider keys ride in Console workspaces.
The contrast in key custody decides who pays. Keys in a local env var expose one machine, and a bug still has to reach it. Keys parked in a hosted workspace sit behind one shared service, where a single legacy box nobody decommissioned drains hundreds of users’ wallets in a night. Local-only keys were not the exposure here, and OpenCode’s statements tie the breach strictly to Console-stored credentials.
Running locally is not automatically safer, either. OpenCode’s own local binary shipped CVE-2026-22812 (CVSS 8.8), an HTTP server that let any website run shell commands, and CVE-2026-22813, a markdown renderer that passed raw HTML from model responses into the page. Local tools fail locally; gateway tools fail in bulk. The security model you choose decides which class of morning you wake up to.
Open questions as of this writing
OpenCode marked the incident ongoing at disclosure and has not said how the attacker reached the legacy system, how long access lasted, or who bears the drained balances. The remediation is running with Anthropic, OpenAI and Google, and the advice to every affected user is rotate or revoke. Founder Dax Raad reported his personal accounts under attack the same day. Watch: a postmortem naming the entry vector, a statement on who eats the stolen-token charges, and whether Console workspaces change how third-party keys are stored.
Sources: @opencode disclosure post - OpenCode disclosure email quoted in full - Crypto Briefing via LeoDex: balances drained, vendor remediation - Anthropic-Alibaba distillation campaign (CNBC) - HN item
Related on this site: GLM 5.3 Flash is free in OpenCode - The budget rig under $3,000 is a repurposed console - Twenty-one ways to run a model locally: the engine catalog