On 17 October 2026 OpenCode, an open-source AI coding agent made by Anomaly Innovations, emailed users of its hosted Console service under the subject 'Action Required: Potential provider key breach'. It said it had found 'unauthorized access to a legacy system that we were in the process of decommissioning' and that 'third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed'. On X it added that 1.4% of Console users were affected, that the breach was 'related to a large scale distillation attack', and that it is working with Anthropic, OpenAI and Google. Co-founder Dax Raad said his own accounts were being attacked too. Users reported their provider credits being used up overnight. OpenCode has not yet said how the attackers got in, how long they were inside, or how many keys were taken. The OpenCode program itself, run on your own computer, is not reported to be affected. If you store AI keys in any hosted service, rotate them and set spending limits.
What happened
OpenCode is a free, open-source coding agent: a program that runs in your terminal or code editor and writes, edits and runs code for you, using whichever AI model you point it at. Its GitHub repository passed 215,000 stars (the site's bookmark count, a rough measure of popularity) this week, and the company says more than 16 million developers use it monthly, a vendor figure we cannot check. It is made by Anomaly Innovations, the team behind the SST web framework, and it is a favourite in vibe-coding circles because it works with more than 75 model providers, including the Chinese open models that cost little or nothing.
Besides the free program there is OpenCode Console, a hosted service for teams. One of its features is 'bring your own key': you paste in the key for an AI account you already pay for, say Anthropic or OpenAI, and Console stores it so your whole team can use the model, in the docs' words, 'without ever seeing the provider key'. That convenience is exactly where the trouble was.
On Friday 17 October 2026 the security researcher Matt Johansen posted a screenshot of an OpenCode email at around 15:30 UTC with the words 'Confirmed. OpenCode hacked. Keys stolen.' At 18:08 UTC the company's X account confirmed it: 'We had a security breach last night related to a large scale distillation attack.' By evening the story was number one on Hacker News, the developers' news site, with more than 800 upvotes.
The facts
The email, titled 'Action Required: Potential provider key breach', said: 'We identified unauthorized access to a legacy system that we were in the process of decommissioning. Third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed. Please revoke and replace those keys through the relevant provider's dashboard, update any applications using them, and review recent usage for unexpected activity. We're sorry this happened and will follow up with any updates.'
On X, OpenCode put the impact at 1.4% of Console users, specifically those who had linked an external provider. It said it had emailed everyone affected, that anyone who did not get an email was not impacted, and that it is working with Anthropic, OpenAI and Google on remediation. Then: 'The incident is ongoing so we cannot share more details at this point.' At 18:41 UTC co-founder Dax Raad posted that his 'personal accounts are being attacked now too', adding: 'whole new world with AI-powered hacking.'
The damage showed up as bills. One Hacker News user wrote that the OpenCode email arrived alongside an email from Anthropic saying their $20 of API credit for the month had been used up. Crypto Briefing reported affected users seeing balances drain quickly, some into the hundreds of dollars. Nobody has said who covers those charges.
What OpenCode has not said: how the attackers got into the old system, how long they were inside, how many keys 1.4% represents, or whether every exposed key was actually used. It has also not published evidence for the 'distillation' label. The company's own X post and email are, so far, the only first-hand sources.
The loot was not source code or passwords. It was the right to ask a frontier AI model questions on someone else's bill.
The everyday version
Think of a hotel that offers to hold guests' payment cards at reception, so anyone in the party can charge drinks to the room. Convenient. Then a burglar gets into an old back office the hotel had stopped using but had not yet emptied, photographs the cards, and spends the night buying things in bulk. The guests wake up to the bills, the hotel says 'cancel your cards', and nobody yet knows how the back-office door was opened.
Your own wallet, the key on your own laptop, was never in that office. But if you handed a card to reception, you need a new one today, and you want to know why the old office still had the cards in it.
Is this actually new?
Stolen API keys are an old problem. Developers have leaked them in public code for years, and the big providers run scanners that revoke keys the moment they appear on GitHub. What is newer is the market for them. 'Distillation' means training a weaker AI model on the answers of a stronger one. It is a normal technique when you own both models, and theft when you do it against a rival's terms of service. In February 2026 Anthropic said it had found more than 16 million such exchanges with Claude, routed through about 24,000 fraudulent accounts, which it attributed to the Chinese labs DeepSeek, Moonshot AI and MiniMax, with one proxy network running more than 20,000 accounts at once. Since then, access to frontier models has itself become loot. A hosted store of real customers' keys is a shortcut past all that account-farming, if that is indeed what happened here.
OpenCode has also had a rough year on security. A remote-code-execution flaw (CVE-2026-22812) in versions before 1.0.216 was disclosed in January 2026, and Datadog's researchers reported another in the program's 'serve' mode in September, fixed in version 1.18.22. Neither is known to be linked to this breach, which hit a company server, not the program on your machine. Commenters on Hacker News did note that the project had been warned about how it handled data months earlier, and that Raad's 'AI-powered hacking' line hints at attackers now pointing coding agents at targets and letting them grind for days. That is speculation, not a finding.
What it means
If you got the email: revoke the keys in each provider's dashboard and issue new ones, update every app, script and CI secret that used the old ones, and read your usage logs back to 16 October. If you did not get the email, do the cheap things anyway. Use one key per tool, never one key everywhere. Put a monthly spending cap on each key; Anthropic, OpenAI and Google all offer them, and a cap would have turned a drained account into a blocked one. Prefer the narrowest permissions a provider allows. Keys you added to the OpenCode program on your own computer with the /connect command live in a local file, and OpenCode has said nothing about those being affected.
For the industry, the lesson is about where keys live. 'Bring your own key' has spread to gateways, editors, agents and dashboards everywhere, and each one is a pile of other people's credit cards. Several of the services we cover, including the token resellers, hold keys like this. The providers, for their part, now have to treat stolen keys as a distillation channel, not just a fraud cost. The honest measure of OpenCode will be the root-cause report it owes its users: how the old system was reached, why it still held live keys, and who pays the bills. Until then the only safe assumption is that any key you handed to a hosted service might be in someone else's hands. Disclosure: we use AI tools from several companies, including Anthropic's and OpenAI's, to help produce this brief.
A spending cap would have turned a drained account into a blocked one.
Curious about AI? Come build with us.
Oslo Vibe Coding runs free, beginner-friendly drop-ins where we build real things with AI. No one codes alone.