OpenCode reported a breach affecting Console users with linked AI providers.
Source: OpenCodeThe announcement described the previous night; hours and timezone remain unclear.
Anthropic revoked Claude keys it believed affected.
Lydia Hallie (Anthropic)On October 18, Dax said attempts had continued for 48 hours.
Dax (OpenCode / Anomaly)An OpenAI team member described restoring service and refunding attack-related credits.
Tibo / @thsottiaux (OpenAI)Editorial analogy: a shared desk holds passes to several paid services. A breach at that desk can require replacing the passes, even if the services themselves were not broken into.
An analogy for the mechanism; not an additional claim about the incident.Anthropic revoked Claude keys it believed affected. Lydia Hallie (Anthropic)
On October 18, Dax reported 48 hours of attempts and attributed them to attackers using agents. Dax (OpenCode / Anomaly)
Dax said AI safeguards interrupted the investigation and that access to Daybreak Blue helped. Dax (OpenCode / Anomaly)
Dax’s attribution does not independently establish how attackers used AI or whether it enabled the initial breach.
OpenCode linked the breach to model copying. The broader campaign and actor remain unverified here.
The statements do not quantify stolen keys or financial loss, or establish whether other data was accessed.
OpenCode clarified that this concerns Console, not the OpenCode application.
The defensive-AI account is a participant assessment, not a controlled test or proof of complete containment.
Editorial lesson: an AI access key can carry spending power and permissions. Connecting it to another tool extends where that access must be protected.
Operators unidentified. OpenCode
An OpenAI team member said it worked with OpenCode to restore customers and refund attack-related credits. Tibo / @thsottiaux (OpenAI)
Editorial defense connections; no assertion that a missing control caused this breach.
Use separate, narrowly scoped keys for each integration. Keep an inventory of owners and places that need new credentials after a revocation.
Limited permissions reduce possible consequences; they do not prevent every credential exposure.
Review provider-side usage, spending and key changes. Practice disabling old keys and verifying that replacement access works.
Billing records do not show every data-access action. Restored service does not establish that the full investigation is complete.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
Explore the full AI security frameworkExplore more original accounts in the source report library ↗.
These are source-reported findings. An independent assessment, when available, is labeled explicitly.
01Read this case’s update history →
Reviewed Oct 20, 2026 · Editorial methodology · Structured data