OpenCode Says a Distillation Attack Exposed Provider API Keys for 1.4% of Console Users

TL;DR

OpenCode, the open-source coding agent from Anomaly, told a slice of its users on October 17 to revoke their provider API keys. The company says it found "unauthorized access to a legacy system that we were in the process of decommissioning," and that third-party keys saved in OpenCode Console workspaces "may have been exposed." Its public statement puts the damage at 1.4% of Console users, specifically those who had linked an external provider, and describes the incident as "a large scale distillation attack." OpenCode says it is working with Anthropic, OpenAI and Google to remediate and has not published anything more. If you ever pasted a provider key into Console, revoke it now. Keys you added locally with /connect live in a file on your own disk, and OpenCode has said nothing about those.

What OpenCode has said, and when

The first public sign was a screenshot. Affected users received an email with the subject line "Action Required: Potential provider key breach." One of them posted it to the OpenCode subreddit, and security researcher Matt Johansen reposted it on X at 15:30 UTC with the caption "Confirmed. OpenCode hacked. Keys stolen. Telling customers to revoke." The full email reads:

We identified unauthorized access to a legacy system that we were in the process of decommissioning. Third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed. Please revoke and replace those keys through the relevant provider's dashboard, update any applications using them, and review recent usage for unexpected activity. We're sorry this happened and will follow up with any updates.

OpenCode's own account on X confirmed the breach at 18:08 UTC:

We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users. We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked. The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate.

Co-founder Dax Raad added at 18:41 UTC that "my personal accounts are being attacked now too," calling it a "whole new world with ai powered hacking." The Hacker News thread passed 640 points within hours, and a chunk of it is an argument about whether the headline should say "OpenCode" or "OpenCode Console." That distinction decides whether you have anything to rotate.

Console versus the CLI: which keys are in scope

OpenCode the agent runs on your machine and talks to whichever model provider you configure. OpenCode Console is a separate, optional hosted layer: workspaces, team members, usage reports, budgets, a $10 a month Go subscription for open models (Go Plus is $40), and a provider page where a workspace admin can link the Anthropic, OpenAI, Google, xAI, DeepSeek, Mistral, Groq or OpenRouter account the team already pays for. Cloud providers such as Azure, AWS Bedrock, Google Vertex and Cloudflare AI Gateway can be linked too.

Console's convenience comes from holding the key for you, and that is also what put it in reach. OpenCode's provider docs are explicit: "Console stores the credential and serves each provider through its gateway," so workspace members get the models without ever seeing the key. The secret sits on OpenCode's servers by construction. That is what a "legacy system" with "keys saved in your workspace" means in the email.

Keys you added in the terminal are a different animal. Per the CLI docs, a provider key entered with /connect is written to ~/.local/share/opencode/auth.json on your own disk, and you can list what is stored there with opencode auth list. OpenCode's statement scopes the incident to Console users with external providers linked, and nothing it has published points at the local file. Nothing it has published rules it out in so many words either, so the accurate status of the local file is unmentioned.

Why a "distillation attack" wants your key

Distillation, in Anthropic's definition from its February 2026 report, is "training a less capable model on the outputs of a stronger one." The illicit version pulls millions of answers out of a frontier model through access the operator is not entitled to. That report counted more than 16 million exchanges with Claude across roughly 24,000 fraudulent accounts: over 150,000 attributed to DeepSeek, over 3.4 million to Moonshot and over 13 million to MiniMax, with one proxy network running more than 20,000 accounts at once.

Fraudulent accounts are the expensive way to do it. A stolen key from a paying customer is cheaper and quieter, and the provider's own fraud systems see a legitimate account doing legitimate-looking coding work. Anthropic's September threat report describes exactly this market: "In every instance, the API keys involved were stolen from Anthropic customers' environments," and one fraudulent reseller sold "cheap Claude access" while silently harvesting its customers' credentials to sell onward to other proxy operators. The report's shorthand for what a stolen key buys is "Loot, Compute, Cover."

Think of it as a stolen gym membership card with your credit card on file. The thief gets the workouts, the gym sees a member working out, and you get the invoice. Crypto Briefing reports that some affected users watched their balances drain and saw bills in the hundreds of dollars; those are user reports, not OpenCode figures, and OpenCode has not said who eats the charges. The defenses Anthropic shipped on October 12 add to a victim's bill: Anthropic has charged for blocked requests since September 24, so an extraction attempt your stolen key fails at still lands on your statement.

What to do in the next ten minutes

• Revoke, then replace. Go to each provider's dashboard and kill every key that was ever linked in a Console workspace: Anthropic, OpenAI, Google AI Studio, and any OpenRouter, xAI, DeepSeek, Mistral or Groq key you added there too. Create the replacement first if your app cannot tolerate a gap, then delete the old one.
• Treat cloud credentials the same way. Console can hold Bedrock, Vertex, Azure and Cloudflare AI Gateway credentials. Those are IAM-level secrets, not just model keys, so rotate them and check the audit log on the cloud side.
• Read your usage back to October 16. OpenCode says the breach happened "last night" relative to its October 17 statement. Look for models you do not use, volumes you do not recognize, and traffic outside your working hours.
• Put a ceiling on every key. Spend limits per key or per workspace turn a stolen credential from an open bar into a bounded loss. Anthropic lets you set custom spend and rate limits per workspace (not on the default workspace), and Google's docs recommend restricting a key to the Gemini API only.
• One key per integration. If the same key sits in Console, CI and three side projects, you now have to rotate it in five places. A key per consumer makes the next incident a one-line fix.
• Rotate local keys anyway if it is cheap. Nothing published implicates auth.json, and rotating costs you two minutes.

The year OpenCode has had

This lands three days after OpenCode 2.0, the ground-up rewrite that topped Hacker News on October 14 with claims of "millions of daily users," a rebuilt API, a background service and a plugin system. The repo sits at more than 215,000 GitHub stars. A project at that scale running a hosted credential store is a target, and it had already been warned.

In January, a researcher disclosed that OpenCode started an unauthenticated HTTP server by default, an unauthenticated remote code execution flaw tracked as CVE-2026-22812 and fixed in 1.0.216. In March, Anthropic's lawyers made OpenCode rip out its Claude OAuth plugin, which is one reason users route Anthropic access through a Console-linked API key in the first place. The company's framing of the breach as a "legacy system that we were in the process of decommissioning" is probably accurate and is also the least comforting sentence in security, since every breached system was in the process of being something.

What is still unknown

• The absolute number. 1.4% of an undisclosed Console user base could be dozens of people or thousands. OpenCode has not said.
• The window. "Last night" is the only timing given. There is no statement on when the legacy system was first reached, how long access lasted, or when it was cut off.
• Exposed versus exfiltrated. The email says keys "may have been exposed." The X statement says a distillation attack "impacted" users. Those are different claims, and the user reports of drained balances suggest at least some keys were used.
• Who pays. Anthropic, OpenAI and Google are "remediating" with OpenCode. Whether that includes crediting back stolen usage is unstated.
• Console credits and Go. The statement covers linked external providers only. Nothing has been said about Console's own prepaid credit balances or Go subscriptions.

OpenCode has promised a follow-up. Until a postmortem names the system and the window, treat every key that ever touched Console as burned.

Key Takeaways

• OpenCode confirmed a breach of a legacy Console system on October 17, 2026, and says provider keys saved in 1.4% of Console users' workspaces may have been exposed.
• Console stores linked provider credentials server-side and proxies requests through its gateway; local /connect keys live in auth.json on your machine and are not named in the disclosure.
• OpenCode calls it a "large scale distillation attack." Stolen customer keys are a known supply line for distillation, per Anthropic's February and September 2026 reports.
• Affected users report drained balances and bills in the hundreds of dollars; Anthropic has billed blocked requests since September 24, so failed extraction attempts still cost the key owner.
• Revoke and replace every key that ever touched Console, including cloud credentials, review usage back to October 16, and put spend limits on the replacements.
• The absolute victim count, the intrusion window and who absorbs the charges are all undisclosed; OpenCode says the incident is ongoing.

Sources: OpenCode statement on X (Oct 17, 18:08 UTC), Matt Johansen's post with the notification email, Dax Raad on X, Hacker News discussion, OpenCode Console provider docs, OpenCode Console docs, OpenCode CLI provider docs, Crypto Briefing, Gabriel Anhaia on DEV Community, Anthropic, Detecting and preventing distillation attacks (Feb 2026), Anthropic Threat Intelligence Report, September 2026, Anthropic, distillation defenses (Oct 12, 2026), OpenCode 2.0 announcement, OpenCode RCE writeup (Jan 2026), OpenCode PR #18186