OpenCode, the open-source AI coding assistant, woke up Saturday to the email no developer wants. The company disclosed October 17 that attackers breached a legacy system it was in the middle of decommissioning, and that third-party API keys saved in user workspaces may have gone with it. About 1.4% of OpenCode Console users are affected.

The disclosure landed in two waves: an X post from the official @opencode account on October 17, then emails to affected customers on the morning of October 18. OpenCode said the intruders hit a legacy system that was being phased out, and that “third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed.” Affected users were told to revoke and replace their keys and check their provider bills for anything unexpected.

“We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users,” the company’s post read. “We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers.”

What happened in the OpenCode security breach

According to OpenCode’s notice, circulated as a screenshot in the r/opencode community on Reddit and confirmed by several outlets, the unauthorized access hit a system the company was actively retiring. That detail stings: a server queued for shutdown was still reachable enough to matter.

The company hasn’t said how the attackers got in, how long they were inside, or whether the exposed keys were actually used. “The incident is ongoing so we cannot share more details at this point,” OpenCode said, adding that it is working with Anthropic, OpenAI, and Google to remediate the issue.

One thing worth clarifying: this is a cloud-console problem, not a compromise of the tool itself. OpenCode’s coding agent is open source and runs on your own machine. The keys at risk were the ones users had stored in OpenCode’s hosted Console workspaces: someone else’s infrastructure, someone else’s retired server.

The “distillation attack” label, questioned

OpenCode’s choice of words drew immediate scrutiny. In machine learning, “distillation” means probing a proprietary frontier model with targeted API queries to clone its behavior into a smaller model. It’s a model-theft technique, not a credential-theft technique.

So why call a key leak a distillation attack? The likely read: attackers weren’t after OpenCode at all. They were after the billing. With stolen keys to Anthropic, OpenAI, and Google models, an attacker can hammer high-end APIs to generate training data for a rival model, while the victim’s account pays for every token. The victim’s bill becomes the attacker’s compute subsidy.

Not everyone is buying the label. Coverage from AI Startups News noted the term “distillation attack” typically refers to model training rather than key exposure, and questioned whether it fits here. OpenCode hasn’t elaborated. What’s not disputed is the effect: whatever you call it, users’ paid API access ended up in someone else’s hands.

The bills started arriving fast

The incident turned financial before it turned official. Some developers reported unexpected charges on their OpenAI and Anthropic bills, with bills climbing into the hundreds of dollars, according to CryptoBriefing. AI Startups News reported users seeing surprise charges and even account suspensions or deletions on Google Cloud and OpenAI accounts tied to the incident.

That’s the asymmetry that makes API keys different from passwords. A leaked password gets reset and you move on. A leaked provider key is a bearer token wired to your credit card. Anyone holding it can spend your prepaid credits or rack up billable usage in minutes. There’s no PIN, no second factor, no daily limit by default. Rotate it or eat the bill.

OpenCode said its investigation “to date” found no evidence that other data beyond the keys had leaked, a careful phrasing that leaves room for the investigation to say more later.

If you got the email, do this today

OpenCode’s guidance is short and worth following to the letter:

  1. Revoke and replace your provider keys through each provider’s dashboard: OpenAI, Anthropic, Google, and anything else you linked to OpenCode.
  2. Update every application still using the old keys, or they’ll break the moment you rotate.
  3. Review recent usage on each provider for spikes, unfamiliar projects, or destinations you don’t recognize.

Even if you didn’t get the email, this is a decent prompt to audit your own hygiene. Keys that live in third-party dashboards are only as safe as the least-maintained server behind that dashboard. Check usage graphs, set spending caps where providers offer them, and treat any key stored outside your own machine as one incident away from someone else’s balance sheet.

Why this matters beyond 1.4%

One and a half percent sounds small until you think about who those users are. OpenCode users are developers and teams wiring paid frontier models into their daily workflow. These are exactly the people whose keys open access to the most expensive endpoints on the market. A narrow breach with the right credentials beats a broad breach with nothing worth stealing.

The incident also fits a pattern nobody in AI tooling has fixed yet. Models from the labs themselves have mishandled credentials — OpenAI paused training on tool-use runs after one of its research models posted a researcher’s GitHub token to a public repository, a slip that compromised a customer account at Modal Labs. JPMorgan’s Jamie Dimon has said the bank won’t let outside AI agents touch customer accounts at all. Every new layer of AI tooling is another place your keys can sit, and another legacy server someone forgot to turn off.

OpenCode is an open-source project from Anomaly Innovations (formerly SST), and its community reputation has been built on transparency. Disclosing within hours of the intrusion and naming the affected providers plainly is how you handle this. The open questions now are the hard ones: how the legacy system was reached, whether the stolen keys were used to power distillation at victims’ expense, and whether 1.4% turns out to be the whole story.

Frequently asked questions

What happened in the OpenCode security breach? On October 17, 2026, OpenCode disclosed unauthorized access to a legacy system it was decommissioning. Third-party provider API keys saved in user workspaces may have been exposed, affecting about 1.4% of OpenCode Console users.

Which API keys were exposed? The keys at risk were third-party provider credentials stored in OpenCode workspaces, including keys for OpenAI, Anthropic, and Google. OpenCode named OpenAI and Anthropic keys as examples in its notice.

How do I know if I was affected? OpenCode said it emailed everyone affected individually on the morning of October 18. If you didn’t get that email, the company says you weren’t impacted; only a subset of users with external providers linked were hit.

What should I do if my keys may have been exposed? Revoke and replace your keys through each provider’s dashboard, update every app that used the old keys, and review recent usage for unexpected charges. OpenCode said it is working with Anthropic, OpenAI, and Google on remediation.

Sources: OpenCode’s disclosure via X; OfficeChai; AI Startups News; CryptoBriefing; RuntimeWire; The CyberSec Guru; selfhostpilot.