OpenCode Console breach: what is known and what to do

If you linked your OpenAI, Anthropic or Google keys to the OpenCode Console, check whether you got an email. On October 17 OpenCode said unauthorized access to a legacy system may have exposed provider keys for about 1.4% of its Console users. We could not open OpenCode’s original post, so this article rests on four outlets that quote or summarize it. It separates what OpenCode has said from what outlets and users report, and from what nobody has said yet.

What did OpenCode say happened?

That attackers reached a legacy system and stored provider keys may have been exposed. OpenCode, the open-source coding agent from Anomaly Innovations, wrote that it had “identified unauthorized access to a legacy system” it was decommissioning and that “third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed,” per OfficeChai’s quotes of its post. The post said the breach happened “last night” and was “related to a large scale distillation attack” that affected 1.4% of Console users. OpenCode said it had emailed everyone affected, that anyone without an email was not impacted, and that “the incident is ongoing so we cannot share more details at this point.” Its co-founder Dax Raad also posted that his personal accounts were “being attacked now too.”

Who was affected?

Console users who had saved external provider keys. OpenCode says about 1.4% of Console users were affected and that this was a subset with external providers linked. Startup Fortune notes there is no absolute count of accounts. Several outlets say users who used OpenCode only through the open-source CLI, with keys kept in their local environment, were not affected, but ai-tldr says that is an inference from OpenCode’s wording and Hacker News comments, not a confirmed statement. We found no statement on whether other OpenCode services such as Zen or Go were involved, and the outlets we read do not mention them.

Were the keys used?

Some users say so, but OpenCode has not confirmed it. Outlets report users seeing unexpected charges on OpenAI and Anthropic bills before OpenCode’s announcement, with one developer reporting $400 in unauthorized Anthropic charges, and byteiota says the attackers did not sell the credentials but used them to run queries at victims’ expense. The byteiota claim has no cited source. OpenCode told affected users it could not confirm whether the exposed keys were used maliciously and that its investigation “to date” had found no evidence of other data leaking, according to Startup Fortune. Startup Fortune also reports no provider statement.

What does “distillation attack” mean here?

OpenCode has not said. It used the phrase “large scale distillation attack” and shared no technical detail. In general, distillation means training a model on another model’s outputs, and Anthropic’s October 12 post, which we covered in our look at its distillation defenses, describes distillers using networks of fraudulent accounts, some with stolen payment details, to harvest outputs at scale. Whether the OpenCode attackers used stolen keys that way is our question, not something OpenCode or the outlets say. One outlet ties the incident to Anthropic’s September threat report, but byteiota notes it shows no direct link.

What should you do?

Follow OpenCode’s three steps, then add caps. OpenCode asks affected users to revoke and replace their provider keys through each provider’s dashboard, update any applications using them, and review recent usage. Outlets add practical advice that is theirs, not OpenCode’s:

• Go to the provider directly. Use OpenAI’s, Anthropic’s and Google’s dashboards, not links in an email, to rotate keys (Startup Fortune).
• Check usage back to October 17, looking for spikes or regions you do not operate in (Startup Fortune; byteiota suggests 72 hours).
• Set spending limits so a stolen key cannot run up unlimited charges.
• Update everywhere the key lived, including scripts, CI jobs and teammates’ setups, and search repositories and shell history for old values (byteiota).
• Rotate even if you got no email is editorial advice from ai-tldr, not an OpenCode instruction.

What is still unknown about the OpenCode breach?

• How the attackers got in and how long the legacy system was exposed.
• Whether stored keys were rotated during decommissioning.
• How many accounts and how much money are affected.
• What the providers have done. We saw no statement from OpenAI, Anthropic or Google.
• Timing. OpenCode’s post is dated October 17 and says it emailed users “this morning,” while one outlet says the morning of October 18.
• A root-cause report. None is public.

What to keep in mind

These are our observations:

• The primary source is missing. We rely on outlets quoting OpenCode’s post, which we could not open.
• Stored provider keys were the exposed asset. Keeping long-lived keys in a hosted console concentrates risk.
• Treat charges as unconfirmed totals. The $400 figure is one user’s report.
• Expect updates. OpenCode called the incident ongoing.

Editorial review: October 18, 2026 (AI). Prepared from OfficeChai, Startup Fortune, ai-tldr and byteiota (each read through a summarizing fetch), and Anthropic’s October 12 distillation post which we read earlier. OpenCode’s own post on X could not be opened (403), so every OpenCode quote is as reported by outlets. We did not verify any charge or contact OpenCode or the providers.