OpenCode says a breach exposed saved AI provider keys for 1.4% of Console users

What OpenCode said

OpenCode, the open-source AI coding agent, said on Saturday 17 October 2026 that it had "a security breach last night" which it linked to "a large scale distillation attack." In a post on X the project said the incident "impacted 1.4% of OpenCode Console users", that it had notified all of them by email that morning, and that it was "working with Anthropic, OpenAI, and Google to remediate."

The first version of the post went up at 17:56 UTC. Twelve minutes later OpenCode edited it to add one sentence that matters for most readers: "If you did not get an email you were not impacted, it was a subset of users who had external providers linked." The post also says the incident is ongoing, so OpenCode cannot share more details yet.

OpenCode is built by Anomaly and published under the MIT licence in the anomalyco/opencode repository, which had about 215,000 GitHub stars when we checked. Its Console is the hosted side: an AI gateway where people sign in, buy credits and get an API key for a list of models the team has tested, as the Console documentation describes it. The project shipped its OpenCode 2.0 release only five days earlier.

What the customer email says

The email itself has not been published by OpenCode, but a screenshot of it was posted to the r/opencode subreddit and reposted on X by security researcher Matt Johansen, who wrote "Confirmed. OpenCode hacked. Keys stolen." The subject line reads "Action Required: Potential provider key breach."

The body is short. "We identified unauthorized access to a legacy system that we were in the process of decommissioning," it says. "Third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed." It asks recipients to "revoke and replace those keys through the relevant provider's dashboard, update any applications using them, and review recent usage for unexpected activity," and closes by saying OpenCode is sorry and will follow up with any updates.

Read together, the public post and the email describe two things. Someone got into an old OpenCode system that held API keys customers had saved for other model providers. And OpenCode connects that access to high-volume use of those keys against the providers' models, which would explain why it is working with Anthropic, OpenAI and Google, the providers named in the email and in users' reports.

What users say they saw overnight

Some users noticed the charges first. At 12:35 UTC one developer posted that someone had drained about $50 of Anthropic API credit and about $70 of OpenAI credit, adding that both keys had been added to OpenCode's hosted service. Another user replied two hours later that $100 in Anthropic credit was gone and that an OpenCode email had warned that provider keys saved in the workspace were exposed.

Johansen wrote at 15:18 UTC that people were messaging him about API keys "running up charges" and that he was not yet seeing the incident in the news. Accounts relayed from the subreddit describe more than $400 in unauthorised Anthropic charges overnight, over 200 euros of Gemini and Vertex AI spend that triggered automatic Google Cloud project suspensions, and sudden OpenAI credit alerts.

AI Lookout has not verified any individual bill, and OpenCode has not put a number on the total spend or the number of keys involved. The amounts reported so far run from tens of dollars to a few hundred per account, which is consistent with an attacker spreading load across many keys rather than burning a few.

What a distillation attack means here

Distillation means training one model on the answers of another. It is a normal technique inside labs, which distill their own large models into smaller ones, and a violation of terms of service when someone does it to a competitor's model at scale. OpenCode has not explained what it means by a distillation attack in this case, so what follows is our reading, not its account.

The labs have spent this year fighting exactly this kind of harvesting. In February Anthropic said three AI labs, DeepSeek, Moonshot and MiniMax, had generated over 16 million exchanges with Claude through about 24,000 fraudulent accounts. OpenAI said in September that it had disrupted a distillation campaign with a core cluster tied to people associated with Moonshot, and on 12 October Anthropic described new defences that it says cut the reasoning distillers extract by 10 to 100 times.

Those defences mostly work by spotting suspicious accounts. Stolen keys from real, paying developers are a way around that: the traffic arrives under customers with ordinary histories, and the bill goes to someone else. If that is what happened here, it would explain both the overnight charges and why OpenCode is coordinating with the providers rather than only resetting its own systems.

Which keys were in scope

The scope OpenCode gives is narrow: Console users who had "external providers linked." The Console documentation says that in a team workspace, owners and admins can invite members, choose which models are enabled, set budgets "and connect their own providers." Those saved provider keys are what the email refers to.

Keys that people add only on their own machine are stored differently. OpenCode's provider documentation says that when you add a provider's API key with the /connect command, it is stored locally in ~/.local/share/opencode/auth.json. Nothing OpenCode has said so far suggests those local files were touched, and its statement limits the incident to people who received an email.

The Console's own spending controls are unlikely to help in this case. The documentation describes monthly usage limits for a workspace and for each member, but those cap spending of Console credits. A stolen Anthropic, OpenAI or Google key is billed by that provider, so the limits that matter are the ones set in each provider's own console.

What affected users should do now

If you got the email, the first step is the one OpenCode asks for: revoke every provider key you saved in a Console workspace from the provider's own dashboard, not just from OpenCode, then create new keys and update the tools that use them. Unlinking a key inside OpenCode does not stop someone who already copied it.

Then check usage. Look at request and spend history for each provider from Friday evening onward, and contact the provider's support with the dates if you see traffic you did not make. Set a spending cap while you are there. Anthropic's API documentation says each usage tier carries a monthly spend cap and that organisations can set their own lower limit on the Billing page of the Claude Console. OpenAI and Google Cloud have their own usage limits and budget alerts in their billing settings.

If you did not get an email, OpenCode says you were not affected. Rotating a key you once pasted into any hosted tool is still cheap insurance, and it is worth checking whether a teammate saved shared company keys in a workspace you belong to.

What OpenCode has not said yet

Most of the important facts are still missing. OpenCode has not said what the legacy system was, how the attacker got in, when access began, how many keys were exposed in absolute numbers, or whether anything other than provider keys, such as account emails or OAuth logins, was in the affected system. It has not said whether it will help users recover charges or whether the providers will treat the spend as fraud.

It is also not the project's first security issue this autumn, though nothing links them. On 24 September OpenCode published a high-severity GitHub security advisory for a cross-site request that could make the local OpenCode server install arbitrary packages on npm-based installations. That bug was in the software people run; this incident is in a hosted system OpenCode operates.

OpenCode says it will follow up. A useful postmortem would name the system, give a timeline, say how many keys were affected and explain what the providers found when they looked at the traffic.

Why this matters for coding-agent gateways

Coding agents increasingly sit between developers and several model providers at once. That is convenient: one tool, one login, many models. It also turns the tool's hosted service into a store of keys that each carry a credit line at a frontier lab, which is valuable to anyone who wants model outputs at someone else's expense.

Earlier this month the Tensorlake npm compromise showed attackers going after developer credentials through a package install. This incident shows the same keys sitting in a hosted database. The practical lesson is the same in both cases: keep provider keys scoped and capped, rotate them when a tool you gave them to reports a problem, and watch billing as closely as you would a credit card.