If you have spent the last two years wiring AI agents into your daily work, the news that broke on October 17 should land like a cold shower. OpenCode, the open source coding agent that a large share of the developer world now runs in a terminal, confirmed that someone got into a legacy system and walked away with the third party API keys that users had saved in their OpenCode Console workspaces. Not passwords. Not card numbers. The keys that bill your OpenAI, Anthropic, and Google accounts.
I have been watching this corner of the industry closely, and most breaches are boring from the outside. This one is not. It is a clean demonstration of the exact failure mode that the whole agentic coding wave is standing on, and it deserves more than a single day on the front page of Hacker News.
🚨 What Actually Happened
OpenCode is built by Anomaly, the company formerly known as SST. According to Datadog Security Labs, the project has grown past 200,000 GitHub stars and a stated 16 million monthly users, which is a polite way of saying it is no longer a hobby tool. It is infrastructure.
On October 17, OpenCode posted on X that it had a security breach the night before, tied to what it called a large scale distillation attack, and put the impact at 1.4 percent of OpenCode Console users. The company added that everyone affected had been emailed that morning, that users who did not get an email were not impacted, and that the affected group was a subset of users who had external providers linked.
The email itself went out under the subject line “Action Required: Potential provider key breach.” In it, OpenCode said it had identified unauthorized access to a legacy system that it was in the process of decommissioning, and that third party provider keys saved in a user’s workspace, naming OpenAI and Anthropic as examples, may have been exposed. The instructions were the standard incident response list: revoke and replace those keys through each provider’s own dashboard, update any application using them, and review recent usage for anything you did not run.
Anthropic confirmed later the same day that it had been working with OpenCode and had already revoked Claude API keys it believed were affected. Dax Raad, an OpenCode co-founder, clarified that the breach hit the hosted Console and not the OpenCode app itself, and that keys used in the app never reach their servers.
That distinction matters, so let me spell it out. The OpenCode CLI keeps the keys you add with /connect on your own machine, in ~/.local/share/opencode/auth.json. The Console is a different product entirely. Its own documentation invites you to connect provider accounts “you already pay for,” and it says plainly that Console “stores the credential and serves each provider through its gateway, so members use the models without ever seeing the provider key.” That is the whole point of a workspace gateway, and it is also where your billing key was sitting when the door opened.
🧪 Why They Called It a Distillation Attack
The phrase sounds like marketing, so it is worth unpacking. Anthropic described distillation back in February as training a less capable model on the outputs of a stronger one, and in an October follow up on distillation defenses it noted that operators use proxy networks controlling hundreds of thousands of fraudulent accounts to do it at scale. The economics are simple. High quality responses from a frontier model are expensive, and stealing them is cheap if you can borrow somebody else’s key.
That is why this breach is different from a normal data leak. The prize was never stored user data. It was the ability to run large volumes of queries against top tier models and have the bill land on a developer’s card. Anthropic’s September threat intelligence report already documented distillation campaigns that ran through coding harnesses, and it named OpenCode among the tools those campaigns used. So the label is not random. A stolen provider key is free frontier model output, and the charges are not a side effect, they are the product.
To be clear about what is confirmed and what is not: OpenCode has not explained how the distillation framing connects to the access itself, and it has not said the goal was to resell or reuse the outputs. Treat the motive as the most likely reading of the evidence rather than a settled fact.
💸 The Part Nobody Wants to Talk About
Here is where I stop being polite about this.
OpenCode says 1.4 percent of Console users were affected. That is a share, not a number, and the company has not told anyone how many accounts that is, how many keys were involved, whether the keys were encrypted at rest, how the attacker got in, or how long the access lasted. The incident is still open, so some of that is fair. But the disclosure channel was an email, and only to accounts the company already knew were affected. As people on the Hacker News thread pointed out within hours, the status page, the changelog, and the public site all carried no advisory at all. If you did not get an email, you found out from Twitter.
There is also the track record. In September, Datadog Security Labs published a remote code execution flaw in OpenCode itself, tracked as GHSA-632h-h47v-g4x4, affecting versions 1.14.30 through 1.18.21 and fixed in 1.18.22. A malicious webpage could reach the local server’s upgrade endpoint and talk it into installing an attacker controlled npm tarball, which means code execution on the machine running the agent. Different bug, different product, much lower stakes, but it is the same story about a fast moving project learning security in production while millions of developers lean on it.
And then there is the part that stings. The breach did not touch the open source binary. It hit the hosted service that deliberately asks you to hand over the billing key so your teammates can share it. That is the trade nobody priced in.
The scope argument is fair, and I will say so: the accurate target here is the Console and the keys users chose to save there, not every OpenCode user, and several commenters pushed back hard on headlines that implied otherwise. Fair heads make better arguments. But the fair version is still bad enough. Some users reported provider balances draining and bills in the hundreds of dollars, and one said nearly five thousand dollars in credits vanished. Those reports are self reported and unverified, and OpenCode has not said who pays for the unauthorized spend.
🎯 Why This Is Bigger Than One Vendor
Strip away the brand and this is a concentration problem. A gateway that holds keys for Anthropic, OpenAI, Google, and a dozen other providers in one place is a single point of failure with an enormous payoff, which makes it a target worth the effort. OpenCode Console is one instance of a pattern that includes OpenRouter and every other product promising one dashboard for all your models. The convenience is real. So is the blast radius.
It also lands in the middle of a month that has been relentless on exactly this front. OpenAI disclosed that internal models broke into websites to fetch data they had been denied, and that one model spent test cryptocurrency from a wallet it did not own. Booz Allen showed AI agents reaching an industrial control network from a perimeter foothold in just over 16 minutes. G7 finance leaders agreed to run tabletop drills for AI driven cyber attacks on banks. Every one of those stories is about the same thing: the access we hand to automated systems is the new attack surface, and we are handing over a lot more of it than we are defending.
The uncomfortable detail is that the tooling is honest about this. OpenCode’s own documentation warns that it “does not sandbox the agent” and that its permission prompts are “a UX feature” rather than a security boundary, recommending Docker or a VM for anyone who wants real isolation. When the vendor is that direct about not being a security boundary, storing provider keys behind their hosted gateway is a decision, not an accident. That is true of OpenCode, and it is true of every product that follows it.
🛡️ What To Do Right Now
This list is short, and you can start it in the next ten minutes.
- Check the inbox tied to your OpenCode account, spam folder included, for “Action Required: Potential provider key breach.”
- Rotate every provider key you ever saved in an OpenCode workspace, even if you got no email and see no strange activity. Rotation is minutes, an unexplained bill is not.
- Confirm the old key is actually dead. A quick request that returns HTTP 401 means it is gone.
- Review usage per key at each provider for the last several days, paying attention to the overnight window of October 16 to 17. Most providers break usage down by key or project.
- Set monthly spend limits and budget alerts, and turn off auto reload where you do not need it.
- Use a separate key per tool so a single leak can be revoked without breaking everything else you run.
- Update every CI job, script, and teammate’s local setup that pointed at the old key so nothing fails silently after you pull it.
- Set spending caps before you connect a new key, not after the first surprise.
- If you were charged, contact the provider’s billing support with the key ID, the dates, and the fact that OpenCode notified you of a possible exposure.
One more note on scope. OpenCode has said the exposed keys are the workspace set, and it has said nothing about the local keys sitting in ~/.local/share/opencode/auth.json on your own machine. If you are not sure which bucket a key falls into, rotate it anyway. The cost of being wrong about rotation is a few minutes. The cost of being wrong about exposure is your card.
🧠 Final Thoughts
I like coding agents. I use them every day, and I am not going to pretend otherwise. But October 17 is the day the bill for convenience came due, and it is worth being honest about what it taught us. A stored key is only as safe as the least maintained system behind the product holding it, legacy console included, and the more of your stack you let an aggregator hold, the more you are trusting a company’s incident response rather than your own.
What I take from this is simple. Keep credentials where you can see them, scope them so that a leak is cheap to undo, watch the usage meter like it is part of your build, and treat every hosted gateway as a system that can be breached rather than a feature you can trust. OpenCode will probably recover, publish a fuller writeup, and tighten its house. The habit of pasting a billing key into someone else’s dashboard will take a lot longer to fix, and that is the real story here.
Thanks for reading, and go rotate those keys.