The OpenCode breach is the kind of incident every developer who pastes an API key into a third-party tool has worried about. Anomaly Innovations, the company behind the open-source OpenCode coding agent, said on October 17 that a security breach exposed third-party provider keys belonging to about 1.4% of OpenCode Console users. Some of those users then reported unexpected charges on their AI accounts.
If you use OpenCode, or any coding agent that stores your OpenAI, Anthropic or Google keys on its servers, this is worth ten minutes of your morning.
What happened in the OpenCode breach
OpenCode posted on X that it had suffered a "security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users." Affected users were notified by email on October 17, according to HuggingNews, which first reported the notice.
According to Startup Fortune's Walter Schulze, the company's notice described "unauthorized access to a legacy system" and said third-party provider keys saved in user workspaces may have been exposed. Only people who had linked external AI providers to their Console accounts were in the affected group.
OpenCode said it is working with Google, OpenAI and Anthropic on remediation, and that it "cannot share further details at this time while the remediation process continues." It has not said how many accounts the 1.4% represents.
The unauthorized charges
Users on X reported usage bills they did not recognise after their keys were taken. One wrote that "people's API keys are running up charges." Startup Fortune reported claims of bills reaching hundreds of dollars, though it could not independently verify individual cases, nor posts claiming that one developer's Google project was suspended and another's OpenAI account was deleted.
Why "distillation" matters here
Distillation is the practice of collecting a model's outputs at scale to train a cheaper copy. Stolen keys are useful for that because the attacker sends millions of prompts and someone else pays. Several commentators pointed out that the label describes what the keys were likely used for, not how they were obtained. OpenCode has not explained the entry point.
What OpenCode is, and why keys matter so much
OpenCode is a terminal-based coding agent rather than a chatbot. It reads files, calls external APIs and runs commands using the developer's own credentials. The provider keys are what make it work, which also makes them the most valuable thing an attacker can grab.
Anomaly's own documentation says OpenCode "does not sandbox the agent" and describes its permission prompts as "a UX feature," recommending Docker or a virtual machine for real isolation. That point is separate from the Console breach, but it is a useful reminder that agent tools operate with broad access by design.
Steps to take today
Even if you did not receive an email, these steps cost little and close the most obvious gaps.
- Revoke and reissue your provider keys. Do it directly in the OpenAI, Anthropic and Google dashboards. Do not click links in any breach email; type the dashboard address yourself.
- Check usage and billing back to October 17. Look for spikes in token volume, unfamiliar models or calls at odd hours.
- Set hard spending limits. All three major providers let you cap monthly spend or set alerts. A capped key that is stolen costs you the cap, not an open-ended bill.
- Use one key per tool. If each agent or app has its own key, you can revoke the compromised one without breaking everything else, and your logs show which tool leaked.
- Keep keys local where you can. A key in a local environment variable is not exposed by a vendor's server breach. Startup Fortune notes it is still unclear whether keys in local config files were affected, so rotating those too is the safe call.
- Isolate agents. Run coding agents in a container or VM, as OpenCode's own documentation suggests, so a misbehaving agent or compromised session cannot reach everything on your machine.
Questions OpenCode has not answered yet
- How the attackers got into the legacy system
- How many accounts the 1.4% figure covers
- When the access was first detected
- Whether any data besides provider keys was taken
The company says its investigation "to date" has found no evidence of other data leaking.
The bigger picture for AI developers
The breach lands in a busy week for agent tooling. DeepSeek just opened a paid search API to all developers, and model providers are competing hard for agent workloads (see our report on DeepSeek V4.1-Flash-1017 and its new search API). Every one of these services is billed per call, which means a leaked key is a direct line to someone's wallet.
For developers in Africa and other markets where a few hundred dollars of surprise charges is a serious hit, spending caps are not optional. Treat an AI provider key the way you would treat a card number: limit what it can spend, know where it is stored, and replace it the moment a tool you trusted reports a problem.
We will update this story when OpenCode publishes a full incident report.
