Anomaly Innovations (formerly SST) confirms a breach exposed OpenAI, Anthropic, and Google API keys for **1.4% of OpenCode Console users**, affecting those with linked external provider accounts. The company, which builds the terminal-based coding agent OpenCode, reported the incident stemmed from a 'large-scale distillation attack' on a legacy system. Affected users received emails urging immediate key rotation, though some already faced unauthorized charges on their OpenAI and Anthropic bills. OpenCode’s design—lacking sandboxing—means exposed keys grant full access to developer accounts, bypassing permission controls. The breach highlights recurring risks in AI tooling handling sensitive credentials, with developers now scrambling to revoke keys and audit usage.
SST builds OpenNext, an open-source project intended to improve deployment support for modern frontend frameworks. The post says these applications combine services such as storage, serverless functions, databases, CDNs, and edge infrastructure, while frameworks update rapidly and major cloud providers offer limited support. OpenNext makes the deployment work open source and enables providers including Cloudflare, Netlify, and Vercel to contribute and keep integrations current.
