OpenCode breach may have exposed stored OpenAI, Anthropic and Google keys

OpenCode said it suffered a security breach overnight that was related to what the company called a “large scale distillation attack.” The company said about 1.4% of OpenCode Console users were affected, not 1.4% of everyone who uses its open-source coding agent.

The Console lets developers connect external AI providers so OpenCode can call their models with the developer's credentials. OpenCode said the affected accounts were a subset of users who had linked those providers.

A legacy system put stored keys at risk

Startup Fortune reports that Anomaly Innovations, the company behind OpenCode, emailed affected users on Oct. 17. The notice said someone gained unauthorized access through a legacy console system that was being decommissioned, and that provider keys stored in user workspaces may have been exposed.

The potentially affected credentials included keys for OpenAI, Anthropic and Google, according to the report. OpenCode said it notified every affected user by email and that people who did not receive a notice were not affected. It did not publish enough technical detail to show how the attacker gained access or what it meant by a distillation attack.