OpenCode, the open-source AI coding agent built by Anomaly Innovations, has disclosed a security breach in which attackers gained access to provider API keys that some users of its paid Console product had saved in their workspaces. The company says the incident, which it describes as a large-scale distillation attack, impacted 1.4% of OpenCode Console users, and that keys for OpenAI, Anthropic and Google models were among those that may have been exposed.
OpenCode notified affected users by email and in a public statement on October 17. If you did not receive that email, the company says, you were not impacted.
What OpenCode Has Confirmed
In its statement, OpenCode said: “We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users. We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked.”
The customer email, with the subject line “Action Required: Potential provider key breach”, said the company had identified unauthorised access to a legacy system that it was in the process of decommissioning, and that third-party provider keys saved in a user’s workspace may have been exposed. Affected users were told to revoke the keys through each provider’s own dashboard and to monitor their accounts for unexpected usage.
OpenCode says the incident is ongoing and that it cannot share more technical detail yet. It says it is working with Anthropic, OpenAI and Google to remediate.
Why A Distillation Attack Targets Keys, Not Data
The asset taken here was not source code or personal data. It was billable access. An API key for a frontier model is a metered line of credit: whoever holds it can run queries and send the bill to the key’s owner. That is what makes the “distillation attack” label significant — running high volumes of queries against a powerful model is how an attacker harvests the input-output pairs used to train or refine a cheaper imitation model, with the compute costs charged to the victims.
Consistent with that pattern, some affected users have publicly reported unauthorised usage and charges on their provider accounts, in amounts ranging from around $100 to four figures in the reports seen so far. Those individual reports are user accounts, not figures OpenCode has confirmed, and the company has not put a total cost on the incident.
OpenCode is not a niche tool, which is why the blast radius matters. The project works with models from more than 75 providers, its GitHub repository has about 215,000 stars, and the company says 16 million developers use the agent every month. Our explainer on AI coding tools covers where terminal agents like OpenCode sit in that market.
What Affected Developers Need To Do
The remediation is manual and per provider. A saved key has to be revoked in the provider’s own dashboard — OpenAI, Anthropic or Google — then reissued, and every application, CI job and teammate setup that used the old key has to be pointed at the new one. Deleting the key inside OpenCode alone does not close the hole, because the exposed credential works anywhere.
The incident also lands on a workflow habit the whole sector shares. Coding agents such as the ones compared in our look at Claude Code, Cursor and Copilot all ask developers to hand over provider keys, and hosted consoles that store those keys concentrate the risk in one place. A legacy system being decommissioned turned out to be the weakest link in that chain.
Developers who saved keys in any hosted coding console, not just OpenCode’s, should treat this as a prompt to set spend caps on every provider account and to rotate keys that live in third-party workspaces. Our explainer on Claude Code shows how much capability a single connected key can carry.
Why It Matters
The central entity is the OpenCode Console breach, and it marks a shift in what attackers steal from AI developer tools. The keys exposed here are working credentials for the most expensive models in the industry, and their value is immediate: free frontier compute for whoever holds them, paid for by the developer who saved them. For OpenCode, the test is whether a fast disclosure — email first, public statement the same day, a clear statement of who was not affected — is enough to hold developer trust. For every other agent platform storing customer keys, the lesson is that key storage is now a security product in its own right, and a decommissioned legacy system is part of the attack surface until it is actually off.
Background
OpenCode grew out of the terminal-first wave of AI coding agents: an open-source agent, built by Anomaly (Anomaly Innovations), that runs in a terminal, editor or desktop app and lets developers bring their own model keys instead of buying a bundled subscription. That bring-your-own-key design is the reason a hosted console ended up holding live OpenAI, Anthropic and Google credentials for so many developers at once — the openness that made OpenCode popular, with about 215,000 GitHub stars, is the same design that made those stored keys a target worth a dedicated distillation attack.
Source: The Latent, October 17, 2026, reporting OpenCode’s official statement and customer email; OfficeChai, October 17, 2026
0 Comments