OpenCode Console breach exposes stored AI provider keys

OpenCode, the open-source AI coding agent, said on October 17, 2026, that a security breach hit 1.4% of OpenCode Console users. Keys those users had saved for OpenAI, Anthropic and Google may have been exposed. Anyone who stored a provider key there should treat it as stolen and replace it now, because a leaked key lets a stranger run up charges on the owner's account.

The company announced the breach in a post on X at 18:08 UTC. "We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users," it wrote. Affected users had already been told by email, the company said.

What happened

OpenCode is made by Anomaly Innovations, the company formerly known as SST. The tool runs in a terminal and writes code with help from AI models. OpenCode Console is the company's web account system, where users can link their own keys for outside model providers.

The breach notice says the keys may have leaked through a legacy console system that the company was shutting down, according to Startup Fortune. Only users who had linked external providers to their accounts were affected, the report says.

Detail	What OpenCode or the report says
Users affected	1.4% of OpenCode Console users
Who	Users with external model providers linked
Keys at risk	OpenAI, Anthropic and Google
Notice	Email to affected users on October 17
Misuse of keys	The company cannot yet confirm it
Other data	No evidence found so far that it leaked

OpenCode has not published how many people use the Console, so the 1.4% cannot be turned into a head count. The company says it is working with Anthropic, OpenAI and Google on the response.

Two descriptions of the cause

The company has described the cause in two ways. Its X post links the breach to "a large scale distillation attack." The email, as Startup Fortune describes it, points to the old console system. Both can be true at once, but OpenCode has not explained how they connect or when the intrusion began.

Distillation means training a new AI model on the answers of an existing one. A copier sends a huge number of prompts to a strong model and saves the replies as training data. That takes a great many paid requests, and an API key decides who pays for them. An API key is the secret code a program uses to call a model provider, and the provider bills its owner for every request.

Distillation is now an open fight between AI labs. Anthropic said on October 15 that new defenses had cut distillation of Claude by 90 to 99%.

Startup Fortune reports that some users saw charges on their OpenAI and Anthropic bills before the first notice arrived. It gives no amounts, and OpenCode says it cannot yet confirm that any key was misused.

What OpenCode tells users to do

Startup Fortune lists four steps from the company's notice:

1. Revoke every affected key and create a new one in the OpenAI, Anthropic and Google dashboards. Open the dashboards directly, not through links in the email.
2. Check billing and usage logs back to October 17.
3. Set spending limits on each provider account.
4. Update every pipeline, CI job and local setup that used the old key. CI, or continuous integration, is the service that builds and tests code automatically.

What this means for developers

• Rotate first, investigate second. If you ever saved a provider key in OpenCode Console, replace it today, even if no email arrived. A revoked key costs nothing. A live stolen key can cost a great deal.
• Set hard spending caps. All three providers bill per request. A low monthly limit turns a stolen key from an open tab into a bounded loss.
• Give each tool its own key. One key per tool shows at once which key leaked. You can then revoke that one key without breaking every other app and CI job.
• Type the dashboard address yourself. The notice tells users to skip the links in the email. Follow that advice for any breach email, from any company.
• Keep the agent's reach small. Startup Fortune notes that OpenCode's documentation says the tool "does not sandbox the agent" and calls its permission prompts "a UX feature." The report suggests running such agents in Docker or a virtual machine. This breach was on the company's servers, but the lesson is the same: hand any AI tool as few secrets as it needs.
• Watch for the post-mortem. OpenCode still has to say how the legacy system and the distillation attack connect, and when the access started. Until it does, assume any key stored in the Console may be in someone else's hands.