OpenCode Maker Says a Breach May Have Exposed Users' Stored OpenAI and Anthropic API Keys

Anomaly Innovations, the company behind the open source coding agent OpenCode, said on October 17, 2026 that a security breach the night before affected 1.4% of OpenCode Console users. Third party provider keys, such as OpenAI and Anthropic keys, saved in affected workspaces may have been exposed, the company told those users in an email.

OpenCode is a terminal based AI coding agent that works with models from many providers, and its hosted Console lets teams store their provider keys in one place. The company tied the incident to what it called "a large scale distillation attack", a phrase AI labs use for campaigns that copy a model's abilities by harvesting its answers at scale.

What did OpenCode disclose?

OpenCode said in a post on X on October 17, 2026 that the breach affected 1.4% of OpenCode Console users, a subset who had linked external model providers, and that it had emailed all of them that morning. Users who did not get an email were not affected, the company said, adding that the incident was ongoing and that it was working with Anthropic, OpenAI and Google to remediate it.

The email itself carried the subject line "Action Required: Potential provider key breach." It says OpenCode identified unauthorized access to "a legacy system that we were in the process of decommissioning," and asks users to revoke and replace the affected keys through each provider's dashboard, update the applications that use them and review recent usage for unexpected activity. Security researcher Matt Johansen posted a screenshot of the email at 15:30 UTC, about two and a half hours before the first version of OpenCode's public post went up at 17:56 UTC.

OpenCode has not said how many accounts 1.4% represents. The figure refers to Console users, not to everyone who runs the free OpenCode agent, Cyber Security News notes.

Which keys were at risk?

The notice covers provider keys "saved in your workspace," meaning keys stored in OpenCode's hosted Console rather than on a developer's own machine. OpenCode's Console documentation says the Console "stores the credential and serves each provider through its gateway, so members use the models without ever seeing the provider key."

That design is what makes a single breach reach many keys at once. A team owner pastes in an Anthropic, OpenAI or other key, and every member uses it through OpenCode's servers. The OpenCode command line tool works differently: keys added with its connect command are stored locally in a file on the user's computer, according to OpenCode's provider documentation. Neither the email nor the X post mentions locally stored keys.

The email names OpenAI and Anthropic as examples. Google appears in OpenCode's statement only as one of the companies helping with remediation, and the Console catalog also lists providers such as xAI, DeepSeek and Mistral.

Why does OpenCode call it a distillation attack?

OpenCode has not explained the label, and its statements do not say how the attackers got in beyond the legacy system. Distillation means training one model on the outputs of a stronger one; done without permission, it lets a rival copy capabilities for a fraction of the cost.

The label fits a pattern Anthropic has described in detail. In its September 2026 threat intelligence report, Anthropic says illicit distillation is "typically enabled by fraud," including stolen API keys, and that proxy services "will often use stolen API credentials belonging to legitimate companies or individuals" to reach US frontier models. On February 23, 2026, Anthropic said DeepSeek, Moonshot and MiniMax had generated over 16 million exchanges with Claude through about 24,000 fraudulent accounts.

Read together, the two accounts suggest why stored provider keys would interest a distiller: they bill model output to someone else. OpenCode has not confirmed that the keys were used this way. AI researcher Nathan Lambert asked publicly whether the term meant distillation in the training sense or another way of using illegally obtained tokens, Startup Fortune reported.

The breach also lands days after Anthropic told investors on October 14 that 5% to 7% of its revenue came from distillation, a share it expects to fall as it blocks the practice, as reported in its third quarter figures.

What have affected users reported?

Some affected users reported charges they did not make on their OpenAI and Anthropic accounts, with some bills climbing into the hundreds of dollars, according to Crypto Briefing and Startup Fortune. These are individual reports; OpenCode's statements give no loss figure.

OpenCode co-founder Dax Raad wrote on X at 18:41 UTC on October 17 that his personal accounts were "being attacked now too." Neither his post nor OpenCode's statement and email name an attacker.

What we don't know yet

• How the attackers reached the legacy system, when the access began and when OpenCode detected it.
• How many accounts and keys the 1.4% figure covers, and whether any data beyond provider keys was taken.
• Whether the exposed keys were used for distillation, for resale or for something else, and by whom.
• Whether OpenAI, Anthropic or Google will refund charges run up with stolen keys.