OpenCode Console Breach: Stored Provider API Keys, 1.4% of Users, and What to Do Now

OpenCode, the open-source terminal coding agent, says it suffered a security breach on the night of October 16 to 17, 2026. In a post on X, the project's account described it as "a large scale distillation attack that impacted 1.4% of OpenCode Console users," and said affected users were notified by email: if you did not get one, you were not impacted. The company added that the affected group was a subset of users who had external providers linked.

If you use the OpenCode Console and linked an OpenAI, Anthropic or Google key, check your inbox and your provider billing now. The rest of this post separates what OpenCode has confirmed from what second-hand coverage reports, then gives a rotation checklist you can finish in ten minutes.

Sources for the incident are thin so far, and the story is still moving. Everything below is labeled as either the maker's own statement or someone else's report. We will add an update section if OpenCode publishes a fuller write-up.

TL;DR: what is confirmed and what is not

What OpenCode actually said

The primary statement is short. OpenCode's account wrote that it had "a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users," that it notified them that morning, and that the impact was limited to users who had external providers linked. It also said it is working with Google, OpenAI and Anthropic to remediate the incident, and describes the incident as ongoing.

That wording matters. "External providers linked" means the Console held credentials for third-party model APIs on the user's behalf. Those are the keys that let anyone spend your money at OpenAI, Anthropic or Google. A breach of that store is a breach of billing authority, not only of an account.

OpenCode has not published a post-mortem, an indicator list, or a count of affected accounts beyond the percentage. The company has said it cannot share further details yet.

What second-hand reports add

Small beads escaping a cracked vessel, illustrating the OpenCode breach of stored provider keys

Startup Fortune reports that the maker of OpenCode, Anomaly Innovations (the company formerly known as SST), blamed a legacy console system it was in the process of shutting down, and that stored provider keys tied to OpenAI, Anthropic and Google may have been exposed. It also says some users reported charges on their OpenAI and Anthropic bills before receiving the first notice, without giving amounts, and that the company could not confirm whether the exposed keys had been used maliciously. Per the outlet, the company's investigation to date found no evidence that other data leaked.

Treat those details as reported, not verified. They come from one outlet summarizing the company's statements and user reports.

Why "distillation attack" is an odd phrase for a breach

Distillation, in AI, normally means using a strong model's outputs to train a cheaper one. Labs have recently accused rivals of doing it through bulk API access; see our coverage of Chinese labs accused of secretly serving Claude for that side of the story.

Here the phrase seems to describe the motive rather than the break-in. Stolen keys are a way to run large volumes of prompts against frontier models without paying, and the output of those prompts is exactly what a distiller wants. That is consistent with the user reports of unexpected usage, but OpenCode has not said who ran the requests or what they collected. We do not know whether the attacker is a competitor, a reseller, or an opportunist. Do not repeat any attribution you see until a primary source names one.

What to do right now

A vault door with a key beside it, showing why rotating stolen API keys at the provider matters

Do these in order, and do them in the provider dashboards, not through links in any email.

1. Check whether you were told. OpenCode says only emailed users were impacted. If you linked providers in the Console and got no email, still rotate; it costs nothing.
2. Revoke and reissue keys at the source. Delete the old key in the OpenAI, Anthropic and Google consoles, create a new one, and name it so you can tell it apart in logs.
3. Read the usage logs. Look back at least to October 16 for spikes, new models you never call, or traffic at odd hours. Ask each provider's support for a billing review if you find charges you did not make.
4. Set hard spending limits. Per-key or per-project caps turn a stolen key from an open-ended bill into a bounded one.
5. Update every place the old key lived. CI secrets, .env files, shell profiles, other agent tools and proxies. A forgotten copy is the usual way a rotated key keeps leaking.
6. Stop storing provider keys in hosted dashboards when you can. Keep keys in your own secret manager and inject them at run time. If a hosted service needs one, use a scoped, low-limit key made for that purpose.

For the agent security angle, AgentBeam is the agent security platform from the explainx.ai team; it stops AI agents before they take dangerous actions, which complements key hygiene because a leaked key and an over-permissioned agent fail in similar ways.

Why this one matters beyond OpenCode

OpenCode is one of the most widely used open-source coding agents, and we have covered it from several angles: the complete guide, the 2.0 release, and its recent free-model and Go plan limits. Part of its appeal is that you bring your own keys and pick any model. That flexibility has a cost: whoever holds the keys holds your spend.

Three lessons stand out.

Hosted key stores are high-value targets. A single place that holds many users' provider keys is a better prize than any individual laptop. The OpenCode agent runs locally; the Console is a separate hosted surface. Users who treated them as one trust boundary may be surprised.

Legacy systems are where incidents hide. If the reported cause holds, a system being retired still held live credentials. Shutting something down is a security task, not just a product one: revoke what it stores before you switch it off.

Spend caps are the cheapest defense. Nearly every harm reported so far is a bill. Providers let you cap it, and few people do until a day like this one. We made the same point after the rm -rf incident: agents run with your authority, so limit what that authority can do.

It also fits a pattern of attackers going after developers' AI tooling, such as the fake Codex installer ads that delivered a stealer and the grey-market ecosystem around free Claude Code proxies and their data risks. If you want to harden how your agents handle secrets generally, our Beam CLI security skills guide is a practical starting point.

What people are asking

Do I need to stop using OpenCode?

Nothing published says the local open-source agent was compromised, so there is no evidence you need to uninstall it. The reported problem is a hosted Console system holding linked keys. If you only ever ran OpenCode locally with environment-variable keys, your exposure through this incident looks low, though we cannot rule out details OpenCode has not shared.

Can I trust that "1.4%" means I was safe?

1.4% is the share of Console users, not of all OpenCode users, and OpenCode defines the affected group as those who received an email. The number tells you the odds, not your status. Check your email, including spam, and rotate if in doubt.

Will the providers refund fraudulent usage?

We found no statement from OpenAI, Anthropic or Google about refunds for this incident. OpenCode says it is working with them on remediation, but nothing has been promised publicly. Contact each provider's billing support with timestamps from your usage logs.

How do I tell if my key was used?

Open the usage page for each provider and look for requests you did not make: unfamiliar models, big token counts, unusual hours, or an IP or region you do not use. Anthropic, OpenAI and Google all show per-key usage, which is why issuing a fresh, separately named key is useful: any traffic on the old name after revocation is a flag.

Is this connected to the other AI-agent incidents this month?

There is no evidence of a link. The common thread is credentials: agents and tools that hold secrets become targets. Treat it as a pattern, not a single campaign.

What we are watching

• A fuller OpenCode write-up covering the entry point, the time window, and whether anything beyond provider keys was exposed.
• Statements from Anthropic, OpenAI or Google about affected keys, abuse detection, or billing relief.
• Whether OpenCode changes how the Console stores provider credentials, for example by dropping storage in favor of per-session or bring-your-own-vault flows.
• Any named attribution. Until a primary source gives one, treat claims on social media as rumor.

Bottom line

OpenCode has confirmed a breach affecting 1.4% of Console users with linked provider keys, said it notified them, and said remediation with the three big providers is ongoing. Details on cause and scope are still reported rather than confirmed. The action is simple and the same regardless: rotate provider keys at the source, check usage, cap spend, and keep keys out of hosted dashboards where you can.

Related reading

• OpenCode: the open-source AI coding agent guide
• OpenCode 2.0: code mode, background agents and SDK upgrade guide
• OpenCode free DeepSeek V4.1 Flash, Zen and Go limits: what is verified
• Chinese AI labs accused of secretly serving Claude: the distillation story
• Claude Code rm -rf incident and sandbox guide
• Fake Codex installer ads and the AMOS stealer
• Free Claude Code proxy: terms and data risks

Details are accurate as of October 17, 2026 and may change as OpenCode and the model providers publish more.