OpenCode Breach: API Keys Exposed in 'Distillation Attack'

If you saved your OpenAI, Anthropic or Google API keys in OpenCode's Console, check your billing — right now. On the morning of Saturday 17 October 2026, the company behind the open-source coding agent confirmed that attackers had broken into a legacy backend system and potentially exposed the provider keys stored in users' workspaces. The company called it a "large scale distillation attack."

Roughly 1.4% of OpenCode Console users were affected, according to the company, and every one of them was notified by email Saturday morning with an urgent instruction: revoke and replace your keys immediately.

What Actually Happened

Here is the timeline, assembled from OpenCode's public statements and reporting by security outlets including Infosecurity Magazine and DevOps.com:

• Night of 16–17 October: An unauthorized party gained access to a legacy OpenCode Console system that was, in the company's words, "in the process of being decommissioned." The system held API keys that users had saved in their Console workspaces to connect the coding agent to providers like OpenAI, Anthropic and Google.
• Morning of 17 October: OpenCode emailed every affected user, urging them to revoke and replace their provider keys, update any applications using them, and review recent usage for unexpected activity.
• Afternoon of 17 October: OpenCode publicly confirmed the breach on X, calling it a "large scale distillation attack" affecting about 1.4% of Console users, and said it was working with Anthropic, OpenAI and Google on remediation.

OpenCode is built by Anomaly Innovations (formerly SST), and it is one of the most widely used open-source AI coding agents. Crucially, the breach hit the Console — the web-based management hub where teams centralize their model credentials — not the coding agent itself. As co-founder Dax Raad put it on X: "only the OpenCode Console, not OpenCode itself."

Why "Distillation" Changes the Story

This wasn't a garden-variety data breach where criminals go after passwords or payment details. The attackers targeted something far more specific: access to expensive frontier AI models. The term "distillation attack" points to a concrete objective — using a powerful model's outputs at scale to train or refine a separate, cheaper model. Knowledge distillation works by collecting huge numbers of input-output pairs, and the fastest way to do that is with someone else's API keys.

Affected developers quickly noticed the fallout. Users reported unauthorized token usage overnight, with some facing charges ranging from $400 to over $1,700 on their Anthropic and Google Cloud accounts. Even co-founder Dax Raad confirmed his own personal account was attacked. Anthropic moved fast too: the company's Lydia Hallie confirmed that all suspected leaked Claude API keys were forcibly revoked.

What remains unknown is almost as important as what is known. How the attacker got in, how long the access lasted, exactly how many keys were actually taken, and whether every exposed key was misused — OpenCode has declined to share further technical details, saying the incident is still ongoing.

5 Things Every Developer Should Do Now

Whether or not you received OpenCode's email, the breach is a wake-up call about how much trust we hand to third-party dashboards. Here is the checklist:

1. Rotate your keys — today. If you were notified, revoke and regenerate your API keys directly on the official platforms of OpenAI, Anthropic and Google. Do it on the provider's site, not inside any third-party console. And remember: changing your login password does not invalidate a leaked API key.

2. Audit your billing and usage. Review usage logs and billing records from 17 October onward for anomalous activity. Look for spikes in token consumption, unfamiliar models being called, or activity at hours when you weren't working. Keep evidence of anything suspicious for charge disputes.

3. Update everything that used the old keys. Rotate the keys in your applications, CI pipelines and local configs — anywhere the compromised credentials were stored. One stale key in a forgotten script re-opens the door.

4. Stop treating "bring your own key" dashboards as safe. The breach hit precisely the users who followed the intended workflow: link your provider key in the dashboard so the agent can bill your own account. The convenience feature was the attack surface. Keep master keys out of third-party consoles; use scoped, rate-limited keys with spending caps where providers allow them.

5. Schedule key rotation. Treat API keys like credentials with an expiry date. Regular rotation and per-project keys limit the blast radius the next time a console, plugin or dependency gets breached — because there will be a next time.

The Bigger Picture: Agents Are the New Attack Surface

The OpenCode incident lands in a week already crowded with AI-security warnings — from India's CERT-In advisory on rogue AI agents to OpenAI's own disclosures of unauthorized agent activity. The pattern is consistent: as agents get more capable, the keys, sessions and dashboards around them become prime targets. If you use AI coding tools in your workflow, our guide to the best AI coding assistants covers how the major options handle your credentials — worth a read before you connect anything. And if the security angle has your attention, our breakdown of how AI agents broke into live business systems shows just how real this threat class has become.

Frequently Asked Questions

Was my OpenCode API key exposed?

If you received OpenCode's breach notification email on 17 October 2026, your stored provider keys (OpenAI, Anthropic and/or Google) may have been exposed and should be revoked and replaced immediately. If you did not receive the email, you were not affected — the incident hit only about 1.4% of Console users who had external providers linked in their workspaces. Note that the breach affected OpenCode Console only, not the open-source coding agent itself.

What is a distillation attack?

A distillation attack is a technique where an attacker queries a powerful AI model at massive scale to collect input-output pairs, which are then used to train a separate, cheaper model — a process called knowledge distillation. In the OpenCode case, the attackers used stolen API keys to run high-volume queries against frontier models at the victims' expense, offloading the compute cost onto compromised accounts.

Is changing my OpenCode password enough?

No. Changing a login password does not invalidate leaked API keys. Affected users need to revoke and regenerate their keys directly on the providers' official platforms (OpenAI, Anthropic, Google), update every application or script that used the old keys, and review billing and usage logs from 17 October onward for unexpected activity.

How did the OpenCode breach happen?

According to OpenCode's parent company Anomaly Innovations, attackers gained unauthorized access to a legacy Console system that was in the process of being decommissioned. The exact entry method and how long the access lasted are still under investigation. The company is working with Anthropic, OpenAI and Google on remediation, and said its investigation had found no evidence that other data was exposed.

About the Author

Sidra Salman is the founder of AI Tools Hub, where she writes practical, research-backed guides on AI tools for students and creators. Every guide is tested and written in plain English for a US audience.