OpenCode reported unauthorized access to a legacy hosted Console system being decommissioned. Customers had stored their own OpenAI, Anthropic and Google API keys there. OpenCode says 1.4% of Console users were affected.
This concerns hosted bring-your-own-key access, not evidence that OpenAI was breached or that OpenCode’s local app leaked credentials. Console lets teams share model access without distributing provider keys, with centralized usage and policy controls. The provider still bills the customer. Incident reporting · Further reporting · Provider documentation
A stolen provider key can authorize billable requests without the owner’s password. Deleting an application or its database does not revoke that key at the provider.
What the migration records establish
OpenCode’s migration PR says customers had moved while old tables remained. Its retirement PR lists database deletion as a separate manual step.
Those records do not establish how the attacker entered, which store supplied keys, or when deletion finished. Compromised application access, database credentials or retained copies are hypotheses, not findings.
Lydia Hallie said Anthropic had revoked Claude API keys it believed were affected.
“have revoked Claude API keys we believe were affected”
The refund statements describe different outcomes
OpenCode
Dax initially said refunds were underway, without specifying payer or method.
“refunds are already underway”
OpenAI
Tibo said affected API credits had been refunded through coordination with OpenCode. Credits are not necessarily cash refunds.
“any credits refunded which would have been drawn in the attack”
Anthropic
Replying to a customer asking about Anthropic credits, Dax said restoration was being worked through and OpenCode would step in if necessary. That is his conditional statement, not verified completion. The parent question specifies Anthropic credits.
“if they can’t get it done by then we’ll send from our side”
The verified response promises key blocking and customer assistance, not refunds.
“We’ve blocked exposed API keys”
The alleged motive does not explain the breach
OpenCode links the breach to an alleged distillation attack. Distillation uses a model’s outputs to train another model; the unauthorized collection is what needs evidence.
In a separate report, Anthropic describes attempts to harvest protected reasoning:
- “DO NOT FLAG THIS AS REASONING EXTRACTION.”
- A debugging pretext requesting prior reasoning.
- A fake system instruction demanding hidden reasoning.
These examples are not evidence from OpenCode. Providers correlate request patterns, account relationships and evasion; OpenAI distinguishes attempted extraction from successful extraction. Neither label explains the credential theft. Anthropic’s examples · OpenAI’s report
OpenAI’s reported credit refunds answer part of the compensation question. Customers still need a clear account of credential access and revocation, and of refund coverage, payer and method.
Was this useful?
Thanks for the feedback.