The Short Answer
On the morning of October 17, 2026, Anomaly Innovations — the company behind the popular open-source AI coding agent OpenCode — emailed a subset of users warning that their OpenAI, Anthropic, and Google API keys may have been exposed. Unauthorized access had been detected in a legacy console system the company was in the middle of decommissioning. The company says roughly 1.4% of OpenCode Console users were affected, that it notified every affected account, and that it is working with Anthropic, OpenAI, and Google to remediate. If you ever saved a provider key in an OpenCode Console workspace, revoke it at the provider’s dashboard and reissue it today. Keys added locally to the CLI with /connect were never part of this incident.
What Happened
OpenCode is a terminal-based AI coding agent that runs with a developer’s own model credentials. It reads files, calls external APIs, and executes commands — which means the API keys a user hands it are the thing that makes the tool work. OpenCode also has a hosted side called Console, where users can run the agent in the cloud or link their own third-party provider keys. It was this hosted side that was hit.
According to the email affected users received — subject line “Action Required: Potential provider key breach” — the company found “unauthorized access to a legacy system that we were in the process of decommissioning,” and third-party provider keys saved in some Console workspaces “may have been exposed.” OpenCode named OpenAI and Anthropic keys explicitly; Google keys were also involved.
The public statement came hours later on the project’s X account: the breach was “related to a large scale distillation attack” that impacted roughly 1.4% of OpenCode Console users — specifically the subset who had external providers linked to their accounts. The company said it had notified all affected users by email on the morning of October 17, and that the incident was ongoing. Notably, OpenCode’s status page, changelog, and website carried no advisory at the time — the only notice went to the accounts the company had already identified as affected.
The Timeline
The timeline is the uncomfortable part of this story. Piecing together the company email, developer reports, and independent coverage:
- Night of October 16 into October 17: unauthorized access to the legacy console system begins. The earliest exposure OpenCode could identify was approximately 00:30 UTC on October 17.
- Morning of October 17: OpenCode emails affected users (first wave around 22:51 UTC October 17 per some reports; the notification surfaced publicly on r/opencode at 14:14 UTC).
- October 17, ~22:51 UTC: first notification email (“Action Required: Potential provider key breach”); a second email followed just before 01:00 UTC on October 18.
- October 17 afternoon: security writer Matt Johansen flags the incident on X after developers report keys running up charges; public statement on OpenCode’s X account lands around 17:56 UTC.
- October 17–18: Anthropic confirms it revoked the Claude API keys it believes were affected. OpenCode says it is working with all three providers on remediation.
That gap matters. Roughly 22 hours passed between the earliest identifiable exposure and the first notification. In that window, at least two users reported unauthorized usage — one saw unauthorized Claude API activity on the evening of October 17, another reported about $100 in fraudulent charges. Other public reports mention $400+, $700+, and even $1,700 in unexpected provider spend, though those social-media figures are unconfirmed. The 1.4% figure itself is a percentage with no denominator: OpenCode has not published a Console user count, so it cannot be converted into an actual number of affected people.
Why a Stolen API Key Is Different From Stolen Data
Most breaches steal data — names, emails, passwords — whose value to an attacker is indirect. A stolen AI API key is more like a stolen credit card that is also a compute voucher. Whoever holds it can burn through the victim’s billing quota running inference on frontier models: generating content at scale, distilling outputs to train competing models, or reselling access. There is a reason OpenCode itself tied the incident to a “large scale distillation attack” — model distillation, where a competitor queries a frontier model heavily to collect training data for its own, is exactly the kind of operation that runs through someone else’s API key.
This is also why the damage shows up as money, not identity theft. One user reported OpenAI and Anthropic keys — used only in OpenCode — running up over $400 overnight. Another saw Google project abuse that got a project suspended. Anthropic told one outlet it had revoked the affected Claude keys, but no provider has publicly said it will refund fraudulent usage. If an attacker spent $700 of your API credit, you may simply owe it.
What the Company Got Right — and Wrong
To its credit, OpenCode emailed the accounts it believed were affected rather than staying silent, and it engaged all three model providers for remediation. It was also clear about the blast radius: only Console users with linked external providers; local CLI keys added via /connect never leave the machine and were never exposed.
But the response had real gaps. The detailed hour-by-hour timeline came from a developer posting under the handle zephel01, not from the company. The official X statement offered no technical detail — “large scale distillation attack” is a motive, not an explanation — and the company has not said how a distillation operation connects to unauthorized access in a legacy system, who the attackers were, or what specifically was accessed. And the 22-hour notification gap, during which users were already seeing fraudulent charges, is the part that will be hardest to defend.
What to Do Right Now
If you ever pasted an OpenAI, Anthropic, or Google key into an OpenCode Console workspace — even once, even months ago — treat it as compromised:
- Revoke each key at the provider’s own dashboard, not in OpenCode. OpenAI keys are managed under API keys in your OpenAI dashboard; Anthropic keys in the Anthropic Console; Google keys in Google Cloud Console credentials or AI Studio.
- Reissue a fresh key for each provider and update every consumer of the old key — scripts, CI pipelines, other tools.
- Confirm the old key is dead by calling a provider endpoint with it and checking that it returns an HTTP 401.
- Check billing and usage dashboards for charges you did not make, especially in the October 16–18 window. Set up usage alerts and spending limits now if you never had them.
- Rotate anything downstream: if a key was embedded in a shared script, repo, or service, assume it was copied and rotate related credentials too.
If you did not receive an email from OpenCode, the company says you were not affected — but if you used Console with linked providers and the timeline makes you uneasy, rotating keys is cheap insurance regardless.
How to Protect API Keys Going Forward
This incident is a reminder of a rule that developers already know but rarely follow: every key you store anywhere is a key that can leave through a system you never knew existed. A few habits make the blast radius smaller:
- Scope keys as narrowly as the provider allows. Restrict a key to a single project or use case, and set spending caps. Anthropic, OpenAI, and Google all support usage limits — use them.
- Prefer local over cloud for keys. OpenCode’s own design shows the value here: keys added to the local CLI never reached the company at all. The hosted Console was the exposure surface.
- Use separate keys per tool. One key per application means one revocation per incident, not a cascade across your entire stack.
- Monitor usage like you monitor a bank account. Billing alerts catch abuse in hours instead of weeks. Check who your provider’s abuse-contact email is before you need it.
- Never commit keys to repos or share them in chats and forums — the incident timeline was reconstructed from developers comparing notes in public, and every note shared is another surface.
Related reading: OpenCode’s breach is the latest in a long month of supply-chain incidents — see our coverage of the ConnectWise Cloud Backup breach that reached Microsoft 365 tenants, the Rank Math SEO PRO supply-chain compromise, and the Tensorlake npm compromise.
FAQ
Was I affected by the OpenCode breach?
OpenCode says it emailed every affected account and that anyone who received no email was not impacted. The breach only concerned provider keys saved in OpenCode Console workspaces with linked external providers — roughly 1.4% of Console users. Keys added locally to the CLI with /connect were never exposed.
Which providers’ keys were exposed?
OpenAI, Anthropic, and Google API keys saved in affected Console workspaces. OpenCode’s email named OpenAI and Anthropic explicitly; Anthropic has since revoked the Claude API keys it believes were affected.
What should I do if my key was exposed?
Revoke the key at the provider’s own dashboard, reissue a fresh key, update every consumer of the old key, and confirm the old key returns HTTP 401. Then check your billing dashboard for unauthorized usage between October 16 and 18, 2026.
Will I get a refund for fraudulent charges?
As of this writing, no provider has publicly said it will refund fraudulent usage caused by the breach. Anthropic confirmed it revoked affected keys, but refund policies for abuse-driven spend are handled case by case — contact your provider’s billing support with evidence.
Is the incident over?
OpenCode said on October 17 that the incident was ongoing and that it was working with Anthropic, OpenAI, and Google on remediation. No final technical post-mortem had been published at the time of writing.