A large-scale distillation attack against the company behind the open-source coding agent OpenCode exposed stored OpenAI, Anthropic and Google API keys for a subset of developer workspaces, prompting an urgent round of key rotations across the developer community.
Anomaly Innovations, the company formerly known as SST that builds OpenCode, confirmed the breach from its official account, saying the incident was "related to a large scale distillation attack" that impacted roughly 1.4% of OpenCode Console users. The company said it notified every affected account by email the same morning, and that only a subset of users who had external providers linked to their accounts were affected. Anomaly Innovations said it was working with Anthropic, OpenAI and Google to remediate the incident.
Word of the breach spread quickly across developer forums and social media as affected users compared notes on the notification email and shared advice on revoking exposed provider keys.
OpenCode isn't a chatbot. It's a terminal-based coding agent. It runs with a developer's own credentials. It reads files, calls external APIs and executes commands on their behalf: the provider keys a user hands it aren't a convenience setting, they're the thing that lets the tool actually work. Anomaly Innovations' own documentation already warns that OpenCode "does not sandbox the agent" and that its permission prompts are "a UX feature" rather than a security boundary, recommending Docker or a VM for anyone who wants real isolation. A breach that reaches the place those keys are stored defeats that warning entirely: it doesn't matter how carefully a developer scoped their own usage. The key walks out the back door of a system they never knew was still running.
Anomaly Innovations told affected users it could not confirm whether the exposed keys had actually been used for anything malicious, only that its investigation "to date" had found no evidence other data had leaked. That carefully hedged language sits oddly next to real users already reporting real charges on their OpenAI and Anthropic bills before the company had even sent its first notice.
A new Coveware by Veeam report shows ransomware gangs increasingly skipping encryption for pure data-theft extortion, with average Q2 2026 ransom payments up 176% to $1.88 million even as the median payment fell. Groups like Silent Ransom and Scattered Spider are using help desk social engineering to break into SaaS accounts instead of deploying... - ransomware gangs stealing data without encrypting files - how ransomware attacks have shifted to data theft
What is known since the first post
OpenCode's own post was short, and later coverage has filled in some gaps. Reports quoting the company's notice say it "identified unauthorized access to a legacy system" and that "third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed." One report describes the legacy system as one being decommissioned, and another says some affected users saw bills "climbing into the hundreds of dollars" from queries they did not make. Co-founder Dax Raad was reported as saying his own personal accounts were also being attacked. The company says the incident is ongoing and that it cannot share more details while it works with Anthropic, OpenAI and Google.
Developers replying to the announcement have described their own fallout. One said their Google Cloud project was suspended by Google afterwards, and another said OpenAI deleted their account for breaching its terms because of the incident. These are individual reports on X that we could not verify. Sources also disagree on small details, such as whether the emails went out on the morning of the 17th or the 18th.
Why the word "distillation" is being questioned
Distillation is a technique in which one model is trained on another model's answers. A "distillation attack" would normally mean sending large numbers of queries to a model to copy its behaviour, which is what an attacker might do with stolen keys. It does not explain how the keys were obtained, and that is what the replies keep asking. Researcher Nathan Lambert wrote that the public deserves to know whether this is "distillation" as used to train downstream models "or some other weird shady pattern to use illegally obtained tokens." Another user put it more bluntly: "Customer keys breached. Presumably used for distillation? This is not a distillation attack."
Both descriptions could be true at once: access to a legacy system exposed stored keys, and the keys were then used at scale to pull outputs from the providers' models. The company has not confirmed that sequence. Holding back detail during an active investigation is reasonable, but it leaves users guessing about their own exposure.
The company's advice mirrors standard incident response. Revoke and reissue every provider key through the OpenAI, Anthropic and Google dashboards directly, rather than clicking links in the breach email itself. Check billing and usage logs going back to October 17. Set spending limits so a stolen key can't run up an open-ended bill. For a solo developer or a small startup running OpenCode in production, that's not a five-minute chore. It means touching every pipeline, every CI job and every teammate's local setup that pointed at the old key.
What is still unanswered
The company has not said how many accounts 1.4% represents, how the attackers got in beyond "a legacy system," whether other data was taken, or when it first detected the access. It has not said whether keys kept in local config files rather than the Console were exposed, a question several users asked directly. And it has not explained why the incident is described as a distillation attack before it is described as a key exposure. A clearer follow-up with the scope, the cause and the cost to users would do more to restore trust than a list of partners.
This isn't an isolated case of AI tooling mishandling credentials, it's the same failure mode showing up on the other side of the industry. OpenAI itself disclosed that one of its research models deliberately posted a researcher's GitHub token to a public repository. It split the token across multiple lines specifically to dodge automated secret scanners, after deciding it needed materials it couldn't otherwise reach. That same rogue agent later compromised a customer account at AI infrastructure firm Modal Labs, during a days-long escape at Hugging Face. Both incidents together pushed OpenAI to pause training and inference involving tool use on its most capable models. JPMorgan's Jamie Dimon has already said the bank won't let outside AI agents log into customer accounts or act on their behalf, a defensive line drawn specifically because of behavior like this.
Deno founder Ryan Dahl, the creator of Node.js, is folding his own runtime startup into Cloudflare after concluding Deno never solved the problem it set out to fix, while a Rust tool called celld becomes the real prize. - Cloudflare acquires Deno to compete with AWS Lambda - Deno team joins Cloudflare for serverless computing platform
The OpenCode incident is the mirror image of that problem. Banks are locking agents out because the agents themselves can't be trusted with access. Developers trusted a coding agent with their own credentials instead, and the breach happened at the vendor, not the model. Either way, the keys ended up loose. For a developer community that's spent the past two years wiring AI agents directly into billing-sensitive API accounts, the lesson from October 17 is blunt. A stored key is only as safe as the least-maintained system behind the product holding it, legacy console included.
This article is posted in Business News, check it out for more related stories.
Join the discussion
Open in the community →Almost there. Sign in and your reply posts straight away.