Skip to content
audiotale.net
Sign in
NewsNews

OpenCode breach: provider API keys saved in Console may have been stolen, 1.4% of users hit

OpenCode maker Anomaly Innovations says an attacker reached a legacy system holding third-party OpenAI and Anthropic keys; users should rotate any key saved in a Console workspace.

audiotale.net team

· 6 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What happened
  3. Background
  4. What "distillation attack" means here
  5. What users are reporting
  6. What to do if you used OpenCode Console
  7. What it means
  8. What we don't know yet
  9. What to watch next
  10. Sources

OpenCode, the open-source terminal coding agent, has told some users of its hosted Console that third-party API keys they stored there may have been stolen. The company behind it, Anomaly Innovations (formerly known as SST), says an attacker reached a legacy system it was in the middle of shutting down, and that about 1.4% of Console users were affected. Several users say they have already been billed for usage they did not make, so anyone who saved an OpenAI, Anthropic or Google key in an OpenCode Console workspace should treat that key as compromised until proven otherwise.

Key points

  • OpenCode emailed affected Console users on 17 October 2026 saying it had "identified unauthorized access to a legacy system that we were in the process of decommissioning."
  • The company says the breach hit about 1.4% of OpenCode Console users, a subset of those with external model providers linked to their workspace.
  • Provider keys "saved in your workspace may have been exposed"; the email names OpenAI and Anthropic as examples, and secondary reports add Google.
  • OpenCode calls the incident "related to a large scale distillation attack," says it is ongoing, and says it is working with Anthropic, OpenAI and Google.
  • It has not said how the attacker got in, how many accounts 1.4% is, or whether the exposed keys were actually used; users on Reddit and X report unauthorised charges.

What happened

According to a write-up on DEV Community that quotes the company's email, the message carried the subject line "Action Required: Potential provider key breach." It says OpenCode "identified unauthorized access to a legacy system that we were in the process of decommissioning," and that "third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed."

Security researcher Matt Johansen posted a screenshot of the email to X at 15:30 UTC on 17 October, according to the same write-up. At 18:08 UTC, OpenCode's own account confirmed the incident: "We had a security breach last night related to a large scale distillation attack." The company put the impact at 1.4% of Console users, said it had emailed everyone affected, and said that anyone who did not get an email was not affected. It added that the incident is ongoing and that it cannot share more details yet. Co-founder Dax Raad later posted that his personal accounts were also being attacked, as reported by DEV Community.

The email asks affected users to revoke and replace the keys through each provider's dashboard, update any applications that use them, and review recent usage for anything unexpected.

We could not open the original posts on X, which require a login. The quotes above are as reproduced by DEV Community, Notebookcheck and Startup Fortune, which agree with one another on the wording. Sources differ on small details, such as whether the emails went out on the morning of the 17th or the 18th.

Background

OpenCode is an open-source coding agent that runs in the terminal. It reads files, calls APIs and runs commands using whatever model credentials the developer gives it. The Console is the company's hosted layer on top: according to OpenCode's documentation, as summarised by DEV Community, a workspace can connect provider accounts "you already pay for," and Console stores the credential so team members can use the models without seeing the raw key. That is a common design for team gateways, and it also means the gateway holds a live key that bills the owner's account.

The email talks about keys "saved in your workspace." The command-line tool, by contrast, keeps keys added with its /connect command on the developer's own machine, in ~/.local/share/opencode/auth.json, again per DEV Community's reading of the docs. OpenCode has not said anything about local keys in this incident, and several users have asked. Until it does, there is no evidence that locally stored keys were exposed, and no evidence that they were not.

This is not the project's first security headline. The US National Vulnerability Database lists CVE-2026-22812, a remote-code-execution flaw in versions before 1.0.216, where an unauthenticated local HTTP server could be used to run shell commands. That bug sat in the tool itself; this incident concerns the vendor's own infrastructure, which is a different failure.

What "distillation attack" means here

Distillation is a technique in which a smaller model is trained on the answers of a stronger one. DEV Community cites Anthropic's description of it as training "a less capable model on the outputs of a stronger one," and notes that Anthropic has also written about distillers using networks of fraudulent accounts to get model access.

OpenCode chose the phrase, and has not explained it. Nothing in what the company has published says how a distillation campaign leads to leaked keys. The obvious reading, which the DEV Community author labels as their own and unconfirmed, is that stolen provider keys give an attacker free model output billed to someone else, which is exactly what large-scale distillation needs. Researcher Nathan Lambert, quoted by Startup Fortune, said the public deserves to know whether this is distillation in the training sense "or some other weird shady pattern to use illegally obtained tokens." Both can be true at once: a breach exposes keys, and the keys are then used for bulk extraction. OpenCode has not confirmed that sequence, and we do not either.

What users are reporting

None of the following comes from OpenCode, and we have not verified it. Notebookcheck, citing a Reddit thread, reports one user with $400 in unauthorised Anthropic charges and another with Google usage near €200 and a project suspended for abuse. A commenter said they received usage alerts from OpenAI and Anthropic before OpenCode notified them. Startup Fortune reports bills "climbing into the hundreds of dollars" and individual claims that an account was suspended or deleted by a provider; it could not verify those. Notebookcheck also reports that some people found their OpenCode service keys had expired and that Google or GitHub sign-in failed with "Unable to start social login."

The honest reading is that the company says exposure is possible, while users are posting what look like real charges. The 1.4% figure measures how many accounts were told, not how many keys were misused.

What to do if you used OpenCode Console

This follows the company's own email and the providers' key-management practice.

  1. Revoke and reissue every provider key saved in a Console workspace, using the OpenAI, Anthropic or Google dashboard directly, not links inside an email. For Google, create the replacement first, then disable the old key.
  2. Update every application and CI secret that used the old key, including the Console workspace.
  3. Confirm the old key is dead. A revoked Anthropic key returns HTTP 401, and OpenAI returns 401 for an incorrect key.
  4. Review usage and billing back to 17 October and set spending limits on the replacement keys.
  5. If you only used the CLI with keys on your own machine, there is no public statement that you were affected, but rotating keys you also pasted into the Console is still the safe course.

What it means

For developers who wire coding agents into billing-sensitive accounts, the lesson is old but easy to forget: a stored key is only as safe as the least-maintained system that holds it, and a legacy service being decommissioned is still part of the attack surface. Prefer provider keys with hard spending caps, one key per tool so a revocation is cheap, and short-lived credentials where a provider offers them. For teams, a hosted gateway that holds keys is a convenience that moves risk from each laptop to one vendor.

What we don't know yet

  • How the attacker got into the legacy system, and when the access began.
  • How many accounts make up 1.4%.
  • Whether keys stored locally by the CLI were touched.
  • Whether the "distillation" activity used the stolen keys, and which providers saw it.
  • Who pays for unauthorised charges; DEV Community reports it is not yet clear how they will be handled.

What to watch next

OpenCode has said the incident is ongoing and has not published a technical write-up. A fuller post-mortem, a statement from Anthropic, OpenAI or Google about misuse, and any change to how the Console stores credentials are the things to look for. We will add a dated update here if the company publishes details.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next