On October 18, 2026, OpenCode said it had a security breach "related to a large scale distillation attack that impacted 1.4% of OpenCode Console users". The people affected had linked their own OpenAI, Anthropic or Google keys to the hosted Console. Some of them woke up to charges they never made.
What we know
- Who: OpenCode Console users who had linked an external AI provider. OpenCode says it emailed everyone affected on the morning of October 18, and that if you did not get an email, you were not impacted.
- When: OpenCode's email to affected users gave October 17, 2026, 00:30 UTC as the earliest possible time a key was exposed.
- How: OpenCode says attackers reached an outdated system that was being shut down. Co-founder Dax Raad said they had been targeting OpenCode's systems for at least 48 hours, using AI agents.
- The cost: users reported unauthorized charges from several hundred dollars up to about $1,700, some of it overnight. Some said Google suspended their Cloud projects for activity "consistent with hijacked resources".
- Still open: OpenCode says the investigation is ongoing and has not published a root cause or exactly what was accessed. The report is about the hosted Console; no affected version of the command-line tool has been named.
A "distillation attack" means using someone else's access to send a model huge numbers of requests and keep the answers, usually to train another model. It is about volume, which is why the bills grew so fast.
If you got the email
- Revoke every key you linked and create new ones: in OpenAI (platform.openai.com → API keys), Anthropic (console.anthropic.com → API keys) and Google Cloud (APIs & Services → Credentials). Revoking stops the bleeding; changing the key in OpenCode alone does not.
- Check usage since October 17, 00:30 UTC on each provider's usage page, and note the times and amounts you don't recognise.
- Contact the provider's billing support with those times. OpenCode's message mentioned that reimbursement may be possible for affected users; keep the email and your notes.
- If Google suspended a project, follow the appeal link in Google's notice after the keys are rotated.
Not affected? Rotating keys you have pasted into any hosted tool is still a cheap precaution. A key only needs to leak once.
Why a leaked key costs so much, so fast
A leaked key is used at once and at full speed, at night, when nobody is watching. Most of the safety nets look at the month's total instead of the speed:
- Budget alerts fire when the month's total passes an amount. A key spending $100 an hour against a $500 budget is silent for hours.
- Hard limits stop everything when reached, and many people set them high so a busy day doesn't take their app down. See how OpenAI's limits work.
- Cost data can lag: some providers report cost once a day, so even a careful person checking the dashboard sees yesterday.
Keep the next leak small
- One key per tool and per app. When one leaks, you revoke one key and nothing else breaks.
- Put each app in its own provider project with a hard limit at two or three times a normal month.
- Give dashboards and monitoring tools read-only or usage-only keys where the provider offers them, never a key that can run models.
- Watch the speed of spending, not only the total, on every provider at once.
Where Billeak fits
Billeak would not have stopped this breach, and nothing outside OpenCode could. What it does is notice the bill early: it reads your spending from each provider and alerts you by email, Telegram, Slack, Discord or webhook when it rises far above your own normal, instead of waiting for a monthly total. Anthropic reports cost within minutes; OpenAI cost arrives once a day, but its token usage is close to real time, and Billeak watches both.
We also hold keys, so the same question applies to us. For OpenAI and Anthropic we ask for admin keys that read usage and cost; they are not keys for running models. DeepSeek, Moonshot and SiliconFlow have no read-only keys, so the connect form asks for a separate key only Billeak uses, which you can delete at any time. Every key is encrypted with AES-256-GCM. How we handle keys.
Start free with two providers.