OpenCode, a coding agent from Anomaly Innovations, disclosed a breach that exposed API keys for about 1.4% of its Console users. The company’s own statement describes it as a security incident “related to a large scale distillation attack,” says everyone affected was emailed, and narrows the group to users who had linked external providers. Source: https://www.techmeme.com/261017/p18#a261017p18
Key facts
| Fact | Detail |
|---|---|
| Question answered | OpenCode Breach Hit 1.4% of Console Users and Their API Keys |
| Short answer | Anomaly Innovations, the company behind coding agent OpenCode, says a breach affected about 1.4% of OpenCode Console users and their API keys in what it calls a ‘large scale distillation attack.’ Anthropic say… |
| Reading time | ~4 min |
| Last updated | 2026-10-18 |
If you run a coding agent - or any tool that stores provider keys for you - this is the incident to read closely, because the damage did not land on the vendor.
What is confirmed
- Scope: 1.4% of OpenCode Console users, all notified by email on the morning after the breach.
- Who was exposed: the company says it was “a subset of users who had external providers linked” - meaning keys for services like OpenAI, Anthropic and Google were stored in the affected path.
- Vendor response: Anthropic said it was working with OpenCode on the breach and had revoked Claude API keys it believes were affected, adding that anyone who saved a key in OpenCode should create a new one to be safe.
- Reported impact: users described drained OpenAI and Anthropic balances, and at least one limited Google account. Figures circulating in replies range from a few hundred dollars overnight to $1,700.
Treat the dollar amounts as user reports, not audited losses. Treat the 1.4% and the email-notification policy as the company’s account.
Why API keys are the whole game
A coding agent is a shell with a wallet attached. It needs keys for one or more model providers, and those keys are usually long-lived, broadly scoped, and stored where the agent can read them - because that is the only way the agent can work.
That combination means a single read of the wrong file is not a data leak in the abstract; it is someone else’s compute budget. Stolen keys get used for exactly what they are for: inference. The victim sees it as a bill, not as a breach.
There is a second-order problem: keys are portable. Revoking them is the only real containment, and revocation only happens if someone notices. Anthropic’s statement that it revoked Claude keys proactively is the right move precisely because the alternative is waiting for users to discover a bill.
The terminology is doing something odd
Calling this a “distillation attack” has raised eyebrows. Distillation normally means training a cheaper model on a stronger model’s outputs - a quality/cost problem, not a credential-theft problem. Here the phrase seems to describe the intrusion’s motive (harvesting model access) rather than its mechanism (stealing keys).
Nathan Lambert made the point directly: it is odd to fold an API-key theft into the same term as model distillation, and odd to lump both in with “model transfer stations to China.” When one label covers credential theft, model copying and geopolitics, it stops helping anyone decide what to do.
The practical takeaway is not semantic. It is that the incident is a key-management failure first, whatever the motive behind it.
What to do this week
- Rotate every provider key that touched OpenCode - if you got the email, do it now; if you did not, do it anyway if the key was stored there. Rotation is minutes; a drained balance is not.
- Check usage, not just balances. Look for spikes at hours you do not work, models you do not use, and keys that were never used before.
- Set hard spend caps per provider. Most providers let you cap monthly spend or set a budget alert. A cap converts a breach into an outage instead of an invoice.
- Use scoped, short-lived keys where the provider supports it. A key that can only call one model, with an expiry, limits what a leak is worth.
- Keep agent keys off shared machines and out of synced folders. The most common leak path is not a sophisticated attack; it is a file that got copied somewhere it should not be.
The uncomfortable part for local agents
Local-first tools are usually described as the safer option because your data stays on your machine. That is true for files. It is not automatically true for credentials: a local agent that stores provider keys in a config directory has the same exposure as a cloud one if its process or storage is compromised - and the blast radius is your own accounts.
The distinction worth keeping is: local agents reduce where your data goes, and do nothing by themselves about how your keys are held. Those are separate controls, and both need to be real.
MOOGH runs on your Windows machine and keeps actions visible and approvable, which limits what an agent can do with the access it has: [download MOOGH].
FAQ
Was this a supply-chain attack on the model providers? No evidence of that in the public statements. The reported exposure is OpenCode Console users’ stored provider keys.
Does changing my password help? Only partly. The exposed material is API keys; rotate the keys themselves and revoke old ones at each provider.
How would I notice a stolen key? Usage dashboards and billing alerts. Set a low alert threshold - you want the notification at the first unusual dollar, not at the end of the month.
Is it safe to keep using OpenCode? That is a judgement call. Whatever you decide, rotate keys that were stored before the disclosure and keep spend caps on while you decide.
Related reading: