OpenCode Got Hacked Badly (My API Keys Got Drained)

The OpenCode hack cost one developer $16 and another $3,000, on the same night, with the same attacker and the same stolen list. The attacker didn't decide which bill you got. The limit on your API key did. On October 17, 2026, OpenCode said a "large scale distillation attack" had reached a legacy system and exposed the OpenAI, Anthropic and Google API keys that developers had saved in the OpenCode Console, its web dashboard for bring-your-own-key (BYOK). The terminal app wasn't part of it. In this video I walk through what actually happened in the OpenCode breach, what OpenCode's own public code shows, and the settings to change tonight so a stolen key can't drain your account. OpenCode hasn't said how the attacker got in yet. This video sticks to what the public record shows. ⏱️ CHAPTERS 0:00 Same hack: $16 or $3,000 1:03 What OpenCode is (Console vs terminal) 2:07 The timeline: 17.5 hours to a statement 4:10 The "legacy" database that never got deleted 6:04 Your API key, stored as plain text 7:43 Why "distillation" doesn't fit 9:56 Why hackers want real developer keys 11:40 The ceiling that decided every bill 12:01 OpenAI, Anthropic and Gemini spend limits 14:01 What to do tonight 16:17 The bigger picture 18:44 Wrap-up ✅ WHAT TO DO RIGHT NOW 1. Revoke your keys at the provider (OpenAI, Anthropic, Google Cloud), not just inside OpenCode 2. Rotate every key you've ever pasted into a third-party tool, even if you got no email 3. Turn on OpenAI's hard limit. A spend alert alone stops nothing 4. Turn off auto-reload on prepaid accounts 5. Keep balances at an amount you'd shrug at losing 6. Delete the keys you forgot about 7. Use one key per tool and per service, and keep production keys on your own servers 📺 WATCH NEXT Don't Buy a GPU Instead Build This 32GB Free AI Server Instead: https://www.youtube.com/watch?v=IMVjEsKX5UQ OpenRouter is Quietly Giving Nerfed AI Model (STOP Using Wrong Endpoint): https://www.youtube.com/watch?v=ZsnFX5mEJ4s Do Claude Get Quietly Nerfed After Launch..(We Have Proof): https://www.youtube.com/watch?v=SxLUx8-hN1o Can a Mac Mini Replace your $200 AI Subscription?: https://www.youtube.com/watch?v=3R7yba577uA Your AI Subscription Is Now Worth Less: https://www.youtube.com/watch?v=FWShtLCP4OY How I Got Frontier Performance on 16GB VRAM (Qwen 3.8 27B): https://www.youtube.com/watch?v=h_KqS4GtU3I 📚 SOURCES OpenCode statement (17:56 UTC): https://x.com/opencode/status/2111516673953935833 OpenCode statement (18:08 UTC): https://x.com/opencode/status/2111519637049319818 Colin Parsons ($281 + $168): https://x.com/colinparsonscom/status/2111451256426250580 Preston Zeller ($1,700): https://x.com/prestonzeller/status/2111465966299488370 Matt Johansen: https://x.com/mattjay/status/2111480005435719885 Zach Huston (OpenAI warned first): https://x.com/HueyHuston/status/2111526489825104215 Lydia Hallie (Anthropic): https://x.com/lydiahallie/status/2111563956666110287 Max Weinbach, drained balances: https://x.com/mweinbach/status/2111518053662064829 Max Weinbach, logged request: https://x.com/mweinbach/status/2111518091360575677 Nathan Lambert: https://x.com/natolambert/status/2111549984373911572 Dax Raad, 8,000 fraudulent accounts: https://x.com/thdxr/status/2079248759439884453 Dax Raad, 48 hours of attacks: https://x.com/thdxr/status/2111790511409258796 Victim tally (unofficial): https://x.com/MrNiceTry/status/2112244830554521697 OpenCode commit b9ca4d2: https://github.com/anomalyco/opencode/commit/b9ca4d21b4f241154081143a6f5bef648f5ccfd0 TechCrunch: https://techcrunch.com/2026/10/19/hackers-hit-ai-coding-tool-opencode-running-up-charges-on-users-ai-accounts/ Anthropic, distillation defenses: https://www.anthropic.com/research/distillation-defenses CISA advisory AA26-251A: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a OpenAI spend limits: https://developers.openai.com/api/docs/guides/spend-limits Anthropic spend limits: https://platform.claude.com/docs/en/api/rate-limits Anthropic auto-reload: https://support.claude.com/en/articles/8977456-how-do-i-pay-for-my-api-usage Gemini API billing: https://ai.google.dev/gemini-api/docs/billing Reddit r/opencode thread: https://www.reddit.com/r/opencode/comments/1x8gtvi/opencode_security_breach/ #OpenCode #APIKeys #AISecurity