If you want to know what attackers do with stolen AI API keys, ask the OpenCode users who woke up on 17 October 2026 to overnight charges from OpenAI and Anthropic. Stolen AI API keys are now what leaked cloud credentials were during the crypto mining years: a quick way to turn someone else's account into free compute. The compute is a language model this time, and the bill arrives in hours.
Here is the short version. Attackers got into the hosted OpenCode Console overnight from 16 to 17 October and took third-party provider keys linked by about 1.4% of Console users. If you were affected, revoke those keys at the provider and check your usage logs. If you were not, put hard spend caps, per-app keys and usage alerts in place before your turn comes.
What happened at OpenCode?
OpenCode is an open source AI coding agent. Its Console is a hosted service where users can store keys for OpenAI, Anthropic and Google. According to the email OpenCode sent to affected users, the intruders reached a legacy system the company was in the process of decommissioning.
OpenCode tied the incident to a large-scale distillation attack, where someone fires huge volumes of queries at a model to train a cheaper copy. BleepingComputer reported that the earliest possible key exposure was 17 October at 00:30 UTC. Co-founder Dax Raad said attackers had been working on the company's systems with AI agents for at least 48 hours.
Only Console users with linked external providers were in scope. Raad said the agent itself, run from a terminal or the desktop app, was not involved, because keys used locally never reach OpenCode's servers.
How much did it cost users?
Figures came from users, not from OpenCode. One user posted charges of $281 on OpenAI and $168 on Anthropic from a single night. BleepingComputer cited reports ranging from several hundred dollars to more than $1,700 overnight. Some users said Google suspended their projects for activity consistent with hijacked resources.
Anthropic revoked affected Claude API keys on 17 October, and OpenAI said it worked with OpenCode on refunds. That is decent of them. It is also not a plan.
A bad week for AI keys
OpenCode was not alone. On 21 October, Railway disclosed that an unauthorised third party may have accessed customer environment variables, some of them in decrypted form. Railway said it believes the incident is part of a series of attacks on platform companies aimed at AI inference providers, and it warned upstream providers so they could revoke keys. Users on Hacker News and Railway's Discord reported their keys being used.
That is LLMjacking. The attacker does not want your customer data. They want your model quota.
The same day, Aikido Security reported that LiteLLM 1.107.0 on PyPI, along with its Docker image, shipped an infostealer that grabbed every provider key stored in the proxy database plus cloud credentials. LiteLLM is the gateway many teams put in front of several model providers, which makes it a very tidy place to keep all your keys. Tidy for attackers too.
Three incidents, three entry points: a SaaS console, a hosting platform and a Python package. The prize was the same each time.
Why are AI keys worth stealing?
A provider key is a bearer token for money. It works from anywhere, rarely has an IP restriction, and on plenty of accounts the only real limit is the credit card on file. Distillation needs a lot of tokens. Paying for them yourself is expensive. Spending someone else's is not.
We learned this with leaked AWS keys and crypto miners years ago, and the bill was usually the alarm. With models the burn rate is faster, and the abuse looks like ordinary API traffic until you look at the volume.
What should engineering leaders do now?
Set hard spend caps, not only alerts. OpenAI's own documentation notes that spend alerts do not enforce a cap. Find the control on each provider that actually stops traffic and set it per project, at a number you can afford to lose.
Scope keys to one app and one environment. A shared organisation key means one leak hits everything, and you cannot tell which system leaked it. Scoped keys let you revoke one and keep the rest running.
Alert on usage, not invoices. Track tokens per hour per key, and page someone when a key does three times its normal volume at 2am. The OpenCode victims found out from their phones.
Count your copies. List every third-party tool, gateway and secrets store holding a provider key. Each one is a copy you will have to rotate on a bad night.
Revoke at the source. Deleting a key inside a tool does nothing about copies already taken. Kill it at the provider.
None of this is new. It is the same hygiene most teams adopted for cloud credentials after the mining wave. AI keys simply skipped the lesson, and the people running distillation farms noticed.
Quick answers
Was the OpenCode CLI or desktop app affected?
No. The breach hit the hosted OpenCode Console. Co-founder Dax Raad said keys used with the local agent never reach OpenCode's servers.
Is deleting the key inside OpenCode enough?
No. Revoke the key at OpenAI, Anthropic or Google, create a new one, update your apps and check the provider's usage logs for calls you did not make.
What is LLMjacking?
It is the theft of AI provider keys or gateway access so an attacker can run model traffic on your account. The victim pays for the tokens.
