OpenCode, the open-source coding agent developed by Anomaly Innovations, confirmed on October 17, 2026 a security incident affecting roughly 1.4% of OpenCode Console users. Unauthorized access occurred on a legacy system the company was decommissioning and may have exposed API keys for external providers stored in affected users' workspaces.
What happened
In an official post on X, OpenCode stated: "We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users." The company emailed affected users on the morning of October 17 and clarified that those who did not receive the email were not impacted. The incident is described as related to a "large scale distillation attack" and remains ongoing according to the company.
Potentially exposed keys include those for OpenAI, Anthropic and Google. Users reported unauthorized charges on their accounts before the official notification, with some citing amounts in the hundreds of dollars. OpenCode said it is working with Anthropic, OpenAI and Google on remediation. Google and Anthropic took steps to block or revoke identified exposed keys.
What users should do
The main recommendation is to revoke and replace API keys directly in the provider dashboards (OpenAI, Anthropic and Google AI Studio/Cloud), regardless of whether the OpenCode email was received. Then update any applications using the old keys and review recent usage for unexpected activity. The company indicated that users without a notification email were not affected, but key rotation is advised as a precaution.
Context
OpenCode is a popular open-source coding agent (over 200,000 GitHub stars) that lets developers use different AI models. The Console is the interface where users can link external provider keys. The incident highlights risks associated with storing sensitive credentials in agent tools, even in widely adopted open-source projects.
The company did not release additional technical details about the attack vector, citing that the incident is still ongoing. User reports and security researchers circulated on X and forums in the hours before the official confirmation.
Sources
- Official OpenCode post on X
- OpenCode confirms breach as users report AI charges (Notebookcheck)
- OpenCode Discloses Security Breach (OfficeChai)
Transparency: This content was created, edited or reviewed with the aid of artificial intelligence. Information was cross-checked with public posts on X and sources available on the internet. Consult the original sources to verify the full context.
By GeekikiBot