---
title: Hunt: LLM provider key abuse after the OpenCode Console breach (usage anomalies since Oct 16, org API key audit) | ctxsec
url: https://ctxsec.com/items/hunt-opencode-console-key-abuse
description: "Hunt for abuse of LLM provider keys exposed in the OpenCode Console breach: usage anomalies since Oct 16 and an org-wide key audit."
status: "hunt idea"
published: 2026-10-17
---

> Hunt for abuse of LLM provider keys exposed in the OpenCode Console breach: usage anomalies since Oct 16 and an org-wide key audit.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-opencode-console-key-abuse.md)

hunt idea

2026-10-17

### Hunt: LLM provider key abuse after the OpenCode Console breach (usage anomalies since Oct 16, org API key audit)

Context: [OpenCode Console breach](/items/opencode-console-provider-key-breach-2026-10). Treat any key that was ever saved in a Console workspace as exposed.

1. **Usage anomalies:** per key/project, compare hourly requests, output tokens and cost from Oct 16, 2026, 8:30 PM ET (00:30 UTC Oct 17, the earliest possible exposure per OpenCode's follow-up email) onward against the prior 14 days. Flag sudden 24/7 flat-rate traffic, models your team doesn't use (often the most capable or reasoning tiers), very long outputs and batch-like uniform prompts, all typical of output harvesting.
2. **Key last-used:** in each provider's key list, check last-used times for keys that should be idle; any recent use of a key only stored in Console is suspicious.
3. **Org API key audit:** inventory every provider key (owner, project, scope, spend cap, where it is stored). Find keys pasted into third-party SaaS gateways (OpenCode Console, routers, IDE clouds) and move them to per-tool keys with caps. Use admin usage APIs (OpenAI Usage/Costs API with an admin key, Anthropic Admin API usage and cost reports) to pull per-key data.
4. **Google Cloud:** check API metrics and billing for the Generative Language / Vertex AI APIs by credential, and any project restriction or abuse notices from Google.
5. **Egress/proxy logs:** list hosts and users calling `opencode.ai` inference endpoints to find who used Console in your org, then confirm which provider keys they linked.
6. **Phishing follow-on:** watch mail for fake OpenCode or provider "refund" or "verify your key" lures.

Sources: [OpenCode on X](https://x.com/opencode/status/2111519637049319818) · [OpenCode customer email via Matt Johansen](https://x.com/mattjay/status/2111480005435719885) · [OpenAI usage API](https://platform.openai.com/docs/api-reference/usage) · [Anthropic Admin API usage & cost](https://docs.anthropic.com/en/api/usage-cost-api)