OpenCode, the open-source coding agent made by a company called Anomaly, disclosed a breach of its systems on Saturday, October 17, 2026. The company says 1.4% of users of its online console, OpenCode Console, are affected, all of them people who had connected an account with a model provider. API keys for third-party providers saved in their workspaces, such as OpenAI or Anthropic keys, may have been exposed. OpenCode says it is working with Anthropic, OpenAI and Google to fix the problem.
An API key works like a credit card: every request sent with it is billed to its owner. A copied key can keep running up charges until it is revoked at the provider. Keys like these are also among the hundreds of secrets hackers left open to anyone on their AI agents’ control panels, according to an October 19, 2026 NorForge report.
An email to customers, then a post on X
Affected customers received an email on Saturday with the subject line “Action Required: Potential provider key breach.” In it, OpenCode says it identified unauthorized access to a legacy system it was in the process of decommissioning. It says third-party provider keys saved in the workspace, with OpenAI and Anthropic as examples, “may have been exposed.” The company asks users to revoke and replace those keys through each provider’s dashboard, update any applications that use them and review recent usage.
At 3:30 p.m. UTC, cybersecurity specialist Matt Johansen posted a screenshot of that email on X. Twelve minutes earlier, he had written that he was getting messages from people whose API keys were running up charges.
OpenCode confirmed the incident on X at 5:56 p.m. UTC, then expanded its post at 6:08 p.m. According to the company, the intrusion happened the night before and is related to “a large scale distillation attack.” OpenCode says it emailed every affected user and that anyone who did not get an email was not affected. The incident was still “ongoing” at that point, and the company said it could not share more details.
At 6:41 p.m. UTC, Dax Raad, who builds OpenCode at Anomaly, added that his personal accounts were now being attacked too.
Who is affected
OpenCode runs in a terminal, a code editor or a desktop app. Its website claims more than 16 million developers a month, and its GitHub repository has more than 215,000 stars. The incident hit the console, the online service where a team manages its access to models in one place.
In the console, an owner or an admin connects the accounts the company already pays for at Anthropic, OpenAI, Google or other providers. OpenCode’s current documentation says the console stores the key and serves the models through its own gateway, so team members use the models without ever seeing the key. Those keys, stored on OpenCode’s servers, are the ones at stake.
Developers who only use the command-line tool store their keys on their own machine, in ~/.local/share/opencode/auth.json. OpenCode’s notice does not mention these local keys.
Revocation and spending limits at the providers
Removing a key from the OpenCode console won’t stop someone who already has a copy: it has to be revoked at the provider itself. Google recommends creating the new key before disabling the old one to avoid downtime, unless unfamiliar charges are already showing up.
Spending limits vary by provider. At Anthropic, if the customer hasn’t set a limit, the tier’s monthly cap applies: $500, $1,000 and $200,000 for the Start, Build and Scale tiers, respectively. At OpenAI, a spend alert doesn’t block requests; only the “Enforce a hard limit” option does. At Google, AI Studio offers an experimental per-project cap, but it lags by about 10 minutes, and spending can still go over during that window. Breach notices can also be used as phishing bait.
The link to distillation is still unclear
OpenCode has not explained how the intrusion relates to “distillation.” The term refers to training a model on the outputs of a more powerful one. On February 23, 2026, Anthropic described campaigns like this by three labs (DeepSeek, Moonshot and MiniMax): more than 16 million exchanges with Claude, run through about 24,000 fraudulent accounts and through proxy services that resell access to the models.
As Crypto Briefing sees it, a stolen key provides that same access, with someone else footing the bill. The outlet says some affected users have seen bills of several hundred dollars. OpenCode hasn’t confirmed either the motive or any use of the keys.
The same risk in other tools
The incident involves a single console, but the same risk applies to any service that stores a key on someone’s behalf: an AI plugin for a website, an automation tool, a code editor, a browser extension. API access is pay-as-you-go and billed separately from Claude subscriptions or ChatGPT plans. An agent’s tool calls are charged to its key too: from October 31, 2026, web searches by Claude Code connected to DeepSeek are billed to the DeepSeek account (see our article on DeepSeek’s web search API). The providers offer some safeguards: OpenAI recommends setting an expiration date when each project key is created, and Anthropic allows spending limits per workspace, OpenAI per project. On October 16, Rank Math told sites that had activated a tainted copy of its Rank Math PRO WordPress plugin to replace every API key, as our article on the Rank Math PRO backdoor explains.
Open questions
OpenCode’s email promises updates. Three things remain unclear: how the attacker reached the legacy system, how long the access lasted and how many keys were actually copied.
The 1.4% figure is hard to interpret, because OpenCode does not publish the total number of console users. The email talks about keys that “may have been exposed,” and the reported charges come from user reports, none of which the company has confirmed. The notice also says nothing about accounts connected through a ChatGPT Plus or Pro login, an option OpenCode highlights on its website.
As of about 11:30 p.m. UTC on October 17, we had found no public statement from Anthropic, OpenAI or Google about this incident, or about what happens to the unauthorized charges users have reported.
