OpenCode says intruder reached legacy system, may have exposed AI provider keys of 1.4% of Console users

OpenCode, the open-source terminal coding agent built by Anomaly Innovations (formerly SST), disclosed on Saturday, Oct. 17 that it suffered a security breach the night before. The company says the intrusion may have exposed third-party AI provider keys that users saved in OpenCode Console, its optional hosted service.

In a post on X, the company said the breach was "related to a large scale distillation attack that impacted 1.4% of OpenCode Console users." Only users with external providers linked were affected, it said, and all of them were emailed the morning of Oct. 17 under the subject line "Action Required: Potential provider key breach."

Anyone who did not get that email was not affected, according to the company. It also said the incident was ongoing and that it was working with Anthropic, OpenAI and Google on remediation.

What was exposed

The email says OpenCode identified unauthorized access to a legacy system it was already preparing to shut down. It says provider keys "saved in your workspace may have been exposed."

Console lets a team save its own OpenAI, Anthropic or Google key in a shared workspace. Members can then use the models without ever seeing the key. Those saved keys are the ones at risk.

Co-founder Dax Raad wrote on X that the breach involves "the OpenCode Console, not OpenCode itself." Keys that users add in the command-line and desktop apps stay on the user's machine, he said, and "never come to us."

The 1.4% figure is a share of Console users. It is not a share of everyone who runs OpenCode, and it is not a count of keys. OpenCode has not said how many users that represents.

Why a stolen key is a live problem

A provider key is a bearer credential. Whoever holds a copy can run billable requests on the owner's account until the provider revokes it.

Deleting the key from Console does not revoke it. A budget set in Console cannot cap misuse either, because Console only sees traffic that passes through its own gateway.

OpenCode's email tells recipients to revoke and replace each key in the provider's own dashboard, update every application that depends on it, and review recent usage for unexpected charges. Security firm Cyera adds that affected teams should check bills from Friday, Oct. 16 forward and set spend limits at the provider.

Users report charges; the company has not confirmed misuse

Some users say they are already paying for usage they did not run. On X, Colin Parsons said his OpenAI key was used for $281 and his Anthropic key for $168. Preston Zeller put his losses at $1,700. A Reddit user separately claimed $400 in unauthorized Anthropic usage.

Those are the users' own accounts, and none has been independently verified. OpenCode's wording is that keys "may have been exposed." The company told users it could not confirm whether the keys were used for anything malicious. It said its investigation "to date" had found no evidence that other data leaked.

It is also unclear whether the reported charges stem from this breach. Stolen AI keys are resold on criminal markets and used to run up bills, so a charge on a provider account does not by itself prove where the key leaked.

The distillation claim

Distillation is the practice of pulling a model's answers in huge volume to train a rival model. Anthropic said in September that labs running such campaigns reach its models through networks of fake accounts built on stolen credit cards, stolen logins and harvested API keys. Cyera's summary of that disclosure says Anthropic described China-based labs pulling roughly 190 million exchanges from Claude.

OpenCode has named no one. It has not said how the breach connects to a distillation campaign, whether exposed keys were used to send those queries, how the intruder got in, what the legacy system was, or how long the intruder had access. It declined to share more because the incident is ongoing.

Raad wrote that his personal accounts were also under attack. "Whole new world with AI-powered hacking," he said.

The design question

OpenCode is not a chatbot. It reads files, calls external APIs and runs commands using a developer's own credentials. Its documentation says the tool "does not sandbox the agent" and recommends Docker or a virtual machine for anyone who wants real isolation.

That guidance covers what the agent does on a developer's machine. It does not cover a hosted service that holds copies of the keys. Storing a key only on your own machine versus saving it in Console to share with a team changes who is responsible for protecting it. A key in Console sat on a legacy system that OpenCode was already trying to retire.

What happens next

As of the company's last statement on Oct. 17, the incident was still open. Any Console user who received the notice should treat every linked key as compromised and revoke it at OpenAI, Anthropic or Google, not just in Console.

The open questions are specific. OpenCode has yet to say how the intruder reached the legacy system, how many keys it held, and whether any were used to run the distillation traffic it describes. It has not announced a fuller technical report.