OpenCode Breach Exposed Stored Provider API Keys: Rotate, Cap and Audit Now

OpenCode, the open-source coding agent run by Anomaly Innovations, confirmed a security breach on October 17, 2026 tied to what it calls a “large scale distillation attack.” The company says the incident impacted 1.4% of OpenCode Console users — specifically the subset who had external providers linked — and exposed the stored API keys those users had connected, including OpenAI, Anthropic and Google credentials. Impacted users were notified by email the morning of October 17; OpenCode states plainly that if you did not receive an email, you were not impacted. The company says the incident is ongoing, that it cannot share more details yet, and that it is working with Anthropic, OpenAI and Google to remediate.

The breach did not stay theoretical. Security researcher Matt Johansen confirmed the compromise hours before OpenCode’s official statement, reporting direct messages from OpenCode customers whose API keys were running up charges, and noting the vendor was telling customers to revoke keys. Techmeme’s roundup relays corroborating user reports: one user says keys used only inside OpenCode ran up over $400 overnight, another reports $1,700, and journalist Max Weinbach writes that his own OpenAI and Anthropic balances were drained, his Google account was limited and partially drained, and that OpenCode did email him.

What a “distillation attack” means here

Distillation attacks are normally about model outputs: mass-querying a strong model to train a cheaper imitation of it. Whatever the precise mechanics of this incident turn out to be — OpenCode has not yet disclosed them — the attacker’s monetization path appears to have been the credentials themselves. A stored BYOK (bring-your-own-key) provider credential is a direct pipe to someone else’s billing account. The attacker does not need to exfiltrate code or data; the key is the payload.

That is why the blast radius landed on provider billing dashboards rather than on OpenCode’s own infrastructure, and why remediation involves three companies — Anthropic, OpenAI and Google — rather than one.

The operator checklist

If you run OpenCode Console — or frankly any hosted harness where you have pasted a provider key — treat this as a live drill:

Step	Action	Why
1	Check for the notification email	OpenCode says only emailed users were impacted
2	Rotate every linked key regardless	Revocation is cheap; a drained balance is not
3	Audit provider billing for overnight usage	Johansen and user reports describe charges accruing overnight
4	Set or lower provider spend limits	Caps turn a slow drain into a failed request
5	Reconnect only with scoped, capped keys	Per-tool keys limit the next incident’s blast radius

Even if you were not in the 1.4%, rotate. Breach scopes get revised, and the marginal cost of a rotation is minutes.

The lesson for every BYOK workflow

This incident is less about OpenCode specifically and more about a pattern: developer tools that ask you to connect your OpenAI, Anthropic or Google account for convenience. Every connected harness becomes a custodian of your provider credentials, and the security posture of the cheapest tool in your chain becomes the security posture of your production API keys.

We have covered this custodial gap before, from API key migration drills for agent fleets to the argument that the agent gateway is the control plane enterprises actually need. The OpenCode breach is the concrete version of that abstract warning: a vendor-side compromise at a coding-agent vendor produced direct, immediate charges on end-user accounts at three separate frontier-model providers.

Practical mitigations that generalize beyond this incident:

• Never paste a long-lived production key into a third-party console. Create a dedicated, per-tool key with its own budget.
• Set hard spend limits at the provider. OpenAI, Anthropic and Google all support monthly caps; a cap would have converted several of the reported drains into a truncated bill.
• Prefer gateways over direct keys. A routing gateway holds the credential once, logs every request, and can revoke a lane without touching the provider account.
• Monitor billing daily on any lane an agent can spend from. Overnight runs are exactly when anomaly detection matters most.

What is still unknown

OpenCode says the incident is ongoing and has shared no technical detail: no entry vector, no timeline beyond “last night,” and no confirmation of exactly which provider key types were exposed beyond the implication that all linked external providers were in scope. The 1.4% figure covers Console users overall; the impacted subset is described as those with external providers linked, so the percentage of connected users affected may be higher.

Expect follow-up detail from OpenCode and the three providers as remediation proceeds. Until then, the verified facts are the ones above: a confirmed breach, exposed provider keys, real customer charges, and a vendor instructing users to revoke. If you have a key parked in OpenCode Console — or in any hosted agent tool — this weekend is a good time to rotate it and put a cap on the next one.

Related reading: Open-source coding agents surveyed.

Load X post

Loading this post connects to X.

The original source is available above.

Load X post

Loading this post connects to X.

The original source is available above.