# AI API key security breaches

> Developing situation record from CLSTR: https://clstr.news/situations/ai-api-key-security-breaches
> Updated: 2026-11-01T06:00:02.000Z. Sources: 3. Developments: 2.

Security incidents involving the exposure of third-party AI API keys have been reported across different platforms. 

In October, OpenCode confirmed a breach of its Console service affecting approximately 1.4% of users. Unauthorized actors accessed a legacy system to target keys for providers such as OpenAI, Anthropic, and Google. These keys were reportedly used in a “large scale distillation attack” to harvest model outputs for training competing models, resulting in unauthorized usage charges for some victims. 

In November, cloud hosting platform Northflank disclosed a breach following a threat warning. Customers reported unauthorized use of AI API keys, which could lead to financial losses. Northflank responded by implementing network policy patches, enabling credential rotation for various databases, and providing audit logs to help users monitor account activity.

## Timeline

### 2026-11-01: Northflank reports security breach affecting AI API keys

Cloud platform Northflank has reported a security breach involving the potential exposure of AI API keys, prompting urgent calls for users to rotate all secrets and monitor billing for unauthorized usage.

3 sources. https://clstr.news/cluster/northflank-reports-security-breach-affecting-ai-api-keys

### 2026-10-18: OpenCode Console breach exposes third-party AI API keys

A security breach in the OpenCode Console exposed API keys for OpenAI, Anthropic, and Google for 1.4% of users, potentially enabling model distillation attacks and unauthorized billing.

6 sources. https://clstr.news/cluster/opencode-reports-security-breach-exposing-api-keys

---
Cite as: AI API key security breaches. CLSTR, https://clstr.news/situations/ai-api-key-security-breaches