OpenCode API key breach: a hacker figure of green code reaching for a red warning padlock and API key above a terminal screen

OpenCode API Key Breach: What Happened, Who Is Affected, and How to Rotate Your Keys

ByChris Wade

Key takeaway: On October 17, 2026, Anomaly Innovations disclosed that attackers breached OpenCode Console and stole stored API keys for roughly 1.4% of Console users. The stolen keys connect to OpenAI, Anthropic, and Google, and attackers used them to run up bills reaching hundreds of dollars. If you linked provider keys to OpenCode Console, revoke and rotate them now through each provider’s dashboard.

What happened

OpenCode is an open-source, terminal-based AI coding agent built by Anomaly Innovations (the company formerly known as SST). Unlike a chatbot, OpenCode runs with a developer’s own credentials: it reads files, calls external APIs, and executes commands on their behalf. That means the API keys a user hands it are what make the tool work — and what make those keys valuable to an attacker.

On October 17, 2026, Anomaly Innovations confirmed that attackers breached its OpenCode Console platform — the optional hosted layer where teams share model access, set budgets, and connect provider accounts. The breach impacted roughly 1.4% of OpenCode Console users: a subset of developer workspaces that had linked external providers — OpenAI, Anthropic, or Google — to their accounts, Startup Fortune reported.

The company described the incident as a “large scale distillation attack.” According to its disclosure, attackers exploited vulnerabilities in a legacy system to gain unauthorized access to API keys stored in user workspaces, then ran repeated queries against high-end AI models using the stolen credentials. Affected users reported account balances draining rapidly, with some bills climbing into the hundreds of dollars, Vector Wire reported.

Why it matters

The attackers were not after passwords or payment information — they wanted access to expensive AI model endpoints. A single stored key can be turned into a rented supercomputer for knowledge distillation: running high-volume queries against a frontier model through stolen credentials, then using the collected input-output pairs to train or refine a cheaper model of their own. The compute cost lands on the victim’s bill.

It also exposes a structural risk in the AI developer stack. OpenCode’s Console stores live keys that bill a real card, and as more coding agents and developer tools keep provider keys for multiple upstream model vendors in one place, that single console becomes a very attractive target. OpenCode’s own documentation already warns that the tool “does not sandbox the agent” and that its permission prompts are “a UX feature” rather than a security boundary. A breach that reaches the place those keys are stored defeats that warning entirely.

What to do right now

Anomaly Innovations said it notified every affected account by email and is working with Anthropic, OpenAI, and Google on remediation. The company advised affected users to rotate or revoke their keys immediately. In practice:

  1. Revoke and reissue every provider key through the OpenAI, Anthropic, and Google dashboards directly — not through OpenCode.
  2. Check billing logs back to October 17 for unauthorized usage on all three providers.
  3. Update every consumer of the old keys: local configs, CI jobs, and teammates’ setups that pointed at them.
  4. Consider sandboxing your agent tooling going forward — running coding agents in Docker or a VM, per OpenCode’s own documentation, limits what a compromised tool can reach.

Analysis: why “distillation attack” is the interesting part

The following is analysis, not verified fact. The company’s choice of words — “large scale distillation attack” — is unusual for a credential-theft disclosure. Distillation usually describes training a small model to mimic a large one, not stealing keys. But it makes strategic sense as a description of attacker intent: the keys weren’t the prize, the frontier-model outputs were. If the attackers wanted bulk queries at scale, stealing a few thousand provider keys is cheaper and harder to attribute than buying the compute. That framing, if accurate, would make this one of the clearest public examples of a growing pattern: AI agents don’t just change how we build software, they change what attackers steal and why.

Frequently asked questions

Who was affected by the OpenCode breach?

Roughly 1.4% of OpenCode Console users — specifically those who linked external AI providers (OpenAI, Anthropic, or Google) to their Console workspaces. Anomaly Innovations said it notified every affected account by email on October 17, 2026.

Were local OpenCode keys affected too?

So far, no. According to published accounts of the incident, the breach reached keys stored on OpenCode’s servers in Console workspaces. Keys stored locally on a developer’s own machine (in the local OpenCode auth file) have not been implicated, and the company has said nothing suggesting they were touched.

What should I do if I received the breach notification email?

Revoke and reissue your OpenAI, Anthropic, and Google API keys through each provider’s dashboard, then check your billing logs back to October 17 for unauthorized charges. Update every place that used the old keys, including CI pipelines and teammates’ local setups.

What is a “distillation attack”?

As used by Anomaly Innovations, the term points to the attacker’s apparent goal: using a powerful model’s outputs at scale to train or refine a cheaper model. Rather than stealing data, the attackers allegedly ran repeated queries against frontier models through stolen API keys, shifting the compute bill onto the victims.

Sources


Similar Posts