OpenCode breach leaks stored provider API keys
Partly confirmed
The takeaway
On Oct 17, 2026 OpenCode (made by Anomaly Innovations) said a breach “related to a large scale distillation attack” hit about 1.4% of OpenCode Console users: those who had linked external providers, whose stored OpenAI, Anthropic and Google API keys were exposed.
Status
- Claim
Partly confirmed
- Our reporting
- Medium confidence
- Importance
- 3 of 5
- Last verified
- 18 October 2026
Your AI and this story
- GPT-6 Astra170 days after its cutoff
- Claude Opus 5.5109 days after its cutoff
- Gemini 4 Argon200 days after its cutoff
- Grok 4.7139 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 109 days before it.
Key facts
- OpenCode on X (Oct 17, 18:08 UTC, ~903k views): breach from ‘a large scale distillation attack that impacted 1.4% of OpenCode Console users’; affected users emailed; only users with linked external providers affected; incident ‘ongoing’; working with Anthropic, OpenAI and Google
- Exposed: OpenAI, Anthropic and Google API keys saved in users’ Console workspaces, from a ‘legacy system’ being shut down (per the company notice as reported by Startup Fortune)
- Company: no evidence ‘to date’ that other data leaked; cannot confirm whether keys were used maliciously; advises revoking and reissuing keys in each provider’s dashboard, checking usage from Oct 17 and setting spending limits
- Anthropic’s Lydia Hallie (Claude Code team, Oct 17): Anthropic worked with OpenCode and ‘revoked Claude API keys we believe were affected’
- Unverified user reports on X: unauthorized charges ‘in the hundreds of dollars’, a suspended Google Cloud project, an OpenAI account deleted for terms violations
- Open questions: how attackers got in, how many accounts 1.4% is, and why it is called a distillation attack (commentators incl. Nathan Lambert asked whether it means stolen keys used to harvest model outputs)
What happened
OpenCode, the open-source coding agent built by Anomaly Innovations, emailed affected users on Oct 17 and posted on X that a breach tied to “a large scale distillation attack” had hit about 1.4% of OpenCode Console users. Only users who had linked external model providers were affected; their stored provider API keys (OpenAI, Anthropic, Google) were exposed. The company said the incident was ongoing and that it was working with the three labs. Anthropic’s Lydia Hallie said Anthropic had revoked the Claude API keys it believed were affected. Startup Fortune reported that the keys came from a legacy system being shut down and that some users reported unauthorized charges; those reports are unverified.
The company did not explain the “distillation” label. A plausible reading, not confirmed by OpenCode, is that the attackers wanted other people’s keys to pull large volumes of frontier-model outputs for training their own models while hiding behind many accounts.
Why it matters
Labs have described distillation campaigns run through fake or resold accounts (see Anthropic’s reports). This incident points to a different supply route: stolen keys from third-party agent tools, where users pay the bill. It also shows the risk of storing frontier API keys in hosted consoles of agent tools.
Sources
3 sources from 2 sites. Numbers match the chips in the text.
3 sources: 1 primary, 1 press, 1 reaction
Primary
- OpenCode on X: breach notice (Oct 17)x.com, official
Press
- Startup Fortune: OpenCode breach exposes stored OpenAI and Anthropic keys, prompts urgent key rotationstartupfortune.com, press
Reactions
- Lydia Hallie (Anthropic) on X: Claude API keys revokedx.com, discussion
Changes
- Filed (OpenCode and Hallie posts read via fxtwitter; Startup Fortune)