Tibo's Day 14: OpenAI helped OpenCode-breach API customers back in business, credits refunded
Tibo says OpenAI teamed with OpenCode after the Oct 17 API-key breach: affected OpenAI API customers are back in business and attack-drawn credits refunded. Day 14 of the sprint brings a small quality-of-life improvement.
What happened
Tibo (Thibault Sottiaux, OpenAI's Codex product lead) posted on X that "our team worked with OpenCode to have their users who are also OpenAI API customers back in business and any credits refunded which would have been drawn in the attack." This addresses the Oct 17 OpenCode breach in which attackers accessed users' OpenAI, Anthropic, and Google API keys in what was described as a distillation attack affecting 1.4% of OpenAI Console users. Tibo also marked Day 14 of the 28-day ship-or-reset sprint with a "small quality of life improvement."
Why it matters
The refunded credits and remediation mean developers whose API keys were exposed can keep building without eating the cost of the breach. It also shows OpenAI directly engaging with a third-party ecosystem incident rather than leaving affected API customers to resolve it alone.
Verified
Verified Oct 18, 2026, via QuotaWire's Tibo post feed (quotawire.com). Original posts are on X (@thsottiaux); direct X links were blocked for this check, so QuotaWire's summaries serve as the verified source.
Sources
Get updates like this every morning
- ② Card on Stripe
- ③ 7 days free
Then $2/month · cancel anytime in one click