{"version":1,"type":"story","url":"https://digestai.news/story/opencode-breach-exposes-openai-anthropic-google-api-keys-to-unauthoriz","json":"https://digestai.news/story/opencode-breach-exposes-openai-anthropic-google-api-keys-to-unauthoriz.json","markdown":"https://digestai.news/story/opencode-breach-exposes-openai-anthropic-google-api-keys-to-unauthoriz.md","slug":"opencode-breach-exposes-openai-anthropic-google-api-keys-to-unauthoriz","headline":"OpenCode breach exposes OpenAI, Anthropic, Google API keys to unauthorized charges","summary":"OpenCode’s online service, OpenCode Console, suffered a breach on October 17, 2026, exposing stored API keys for OpenAI, Anthropic, and Google. The company reports 1.4% of users affected, with some developers facing charges of hundreds or over $1,000 for unauthorized usage. OpenCode attributes the breach to a 'distillation attack,' though evidence remains unconfirmed, and the incident is still ongoing as of November 1, 2026. OpenAI, Anthropic, and Google have revoked compromised keys and issued refunds, but OpenCode advises users to revoke and recreate their keys directly with the AI providers to prevent further unauthorized access. The breach highlights risks of entrusting API keys to third-party services, where stolen keys can bypass local safeguards and lead to financial losses.","keyPoints":["OpenCode Console breach exposed 1.4% of users’ OpenAI, Anthropic, and Google API keys on October 17, 2026","Unauthorized charges reached hundreds or over $1,000 for some developers; OpenAI, Anthropic, and Google revoked keys and issued refunds","OpenCode advises users to revoke keys directly with AI providers and recreate them to prevent further unauthorized usage"],"whyItMatters":"The breach underscores vulnerabilities in storing API keys with third-party tools, exposing users to financial losses and highlighting the need for stricter key management practices across AI services.","category":{"slug":"society","name":"Society & Work","url":"https://digestai.news/category/society"},"entities":{"companies":["OpenCode","OpenAI","Anthropic","Google","TechCrunch","BleepingComputer"],"models":[],"people":["Dax Raad","David Sacks"]},"firstPublishedAt":"2026-11-01T03:55:00Z","updatedAt":"2026-11-01T03:55:00Z","sourceCount":1,"hasPrimarySource":false,"sources":[{"outlet":"note.com","title":"AI coding tool OpenCode breached, unauthorized charges made with stored OpenAI, Anthropic, and Google API keys—3 things to decide before entrusting your keys","url":"https://note.com/ai_jissennkai/n/nbfcfe4b95c4b?hl=en","publishedAt":"2026-11-01T03:55:00Z","type":"press","primary":false,"lead":true}],"sourceNotes":null,"discussions":[],"thread":{"title":"AI API Key Breach Cascade","url":"https://digestai.news/thread/anomaly-innovations-says-breach-affected-about-1-4-of-opencode-console-users","storyCount":4},"cite":{"text":"Digest AI, \"OpenCode breach exposes OpenAI, Anthropic, Google API keys to unauthorized charges\", 1 November 2026, https://digestai.news/story/opencode-breach-exposes-openai-anthropic-google-api-keys-to-unauthoriz","publisher":"Digest AI","title":"OpenCode breach exposes OpenAI, Anthropic, Google API keys to unauthorized charges","datePublished":"2026-11-01T03:55:00Z","url":"https://digestai.news/story/opencode-breach-exposes-openai-anthropic-google-api-keys-to-unauthoriz"},"generatedBy":"Written by Digest AI's editorial model from the linked sources; the sources are the record.","license":"Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse"}