OpenCode's Retired Console Leaked Users' AI Provider Keys — and Some of the Bills Were Already Spent

OpenCode, the open-source coding agent built by Anomaly (formerly SST), disclosed on 17 October 2026 that an unauthorized party had reached a legacy Console system it was in the process of decommissioning, and that third-party AI provider keys stored in some users' workspaces "may have been exposed" — O​penAI, A​nthropic and G​oogle credentials among them. OpenCode said the breach affected about 1.4% of Console users, specifically "a subset of users who had external providers linked," and that it had emailed every affected account. The company described the incident as "a large scale distillation attack." Within a day, named users were telling reporters the keys had been used: Dealroom reported $281 in charges on one user's O​penAI key and $168 on the same user's A​nthropic key, more than $700 on another account, and $1,700 on a third.

That gap — between a company statement about a percentage and users holding invoices — is the whole story of this record. The disclosure is short, the technical account is absent, and the financial account comes from the people who were billed.

What OpenCode said, in its own words

The company's public post was three sentences long. "We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users," it read, according to the text quoted on Hacker News and by OfficeChai. "We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked."

A slightly longer community notice, posted by the OpenCode team and reproduced on Hacker News, added the mechanism as far as the company has described it: "We identified unauthorized access to a legacy system that we were in the process of decommissioning. Third party provider keys (eg O​penAI, A​nthropic) saved in your workspace may have been exposed. Please revoke and replace those keys through the relevant provider's dashboard, update any applications using them, and review recent usage for unexpected activity. We're sorry this happened and will follow up with any updates."

What the company did not publish is as important as what it did. As of 19 October 2026 there is no root cause, no description of how the legacy system was reached, no statement of how long an intruder had access, no absolute count of affected accounts behind the 1.4% figure, no total loss figure, no reimbursement policy and no post-mortem. OpenCode said at the time that "the incident is ongoing so we cannot share more details at this point." CyberSecurityNews noted the same absences and added that OpenCode provided no technical evidence connecting the exposed credentials to distillation activity.

The timeline, and where reports diverge

OpenCode's post is dated 17 October 2026 and refers to the breach as having happened "last night," placing the intrusion overnight between 16 and 17 October. The Hacker News submission of the company's statement carries a timestamp of 18:01 UTC on 17 October. Two days later, co-founder Dax Raad said attackers had been "non stop trying to attack our systems for the past 48 hours," and that "my personal accounts are being attacked now too," describing it as a "whole new world with ai powered hacking" (OfficeChai).

The notification timing is the one place where published accounts disagree. OpenCode said it had notified affected users "this morning." Startup Fortune reported that Anomaly emailed affected users on 17 October but noted that sources differ on whether notices went out on the morning of the 17th or the 18th; OfficeChai, which dated both OpenCode's and Raad's posts to 17 October, placed the community statement and the emails on the morning of 18 October. Startup Fortune also reported that users were told to review billing and usage logs going back to 17 October — a cut-off that matters, because some users reported unexplained charges before the first notice arrived.

What was stored, and why it mattered

The exposure is specific to OpenCode Console, the hosted dashboard where accounts, subscriptions and linked provider credentials live — not to the open-source CLI in isolation. Dealroom reported that Console stores users' provider keys on OpenCode's servers, and that OpenCode supports models from more than 75 providers with users supplying their own private API keys. That design is what turned a breach of one internal system into a breach of credentials held at three separate AI labs at once.

OpenCode named O​penAI, A​nthropic and G​oogle as the providers whose keys were in scope, and said it was working with all three "to remediate the issue." The only provider-side action reported so far came secondhand: Dealroom reported that A​nthropic said it revoked affected C​laude API keys. Neither O​penAI nor G​oogle has been quoted directly in the coverage reviewed for this article, and no provider has published its own statement.

The bills users say arrived

The financial harm is not drawn from OpenCode's disclosure — the company has published no loss figure — but from individual users who spoke to reporters. Dealroom's account, published 18 October, names three:

• Colin Parsons, whose O​penAI key was, in the outlet's word, "pounded" for $281, and whose A​nthropic key was charged $168.

• Preston Zeller, who reported losses of $1,700.

• Francisco Giancarelli, who saw more than $700 in O​penAI usage before he stopped it.

Cryptobriefing, which did not name individuals, described bills "climbing into the hundreds of dollars" and stated plainly that the source material does not specify how charges from unauthorized queries will be handled. That remains true two days on: no reimbursement commitment has been published.

Two further categories of harm are alleged but unverified. Startup Fortune reported that one user said G​oogle suspended their G​oogle Cloud project after the incident, and another said O​penAI deleted their account for a terms breach tied to it — individual posts on X that the outlet said it could not verify. Separately, OpenCode's own GitHub issue tracker carries user-filed reports that sit awkwardly with the company's "if you did not get an email you were not impacted" line. Issue #56833, filed 18 October, is from a subscriber who says their workspace never held an O​penAI, A​nthropic or G​oogle key — only an OpenCode Go key — yet their key was revoked without an expiry date set, and who asks for a compensation policy that has not been published. Issue #56703, filed the same day, reports workspaces showing "Workspace access restricted" since 17 October from a user who says they received no breach email. These are unconfirmed user reports, not company statements, but they indicate that the remediation touched accounts outside the emailed subset.

"Distillation attack": what that phrase is doing

OpenCode's framing is a motive claim, not a vulnerability description, and the company has published nothing to support it. Cryptobriefing described the apparent purpose as collecting high-quality model outputs that could be used to train competing models without paying for the compute or original research, and noted that A​nthropic had described similar distillation methods in February 2026. That is a plausible reconstruction of intent. It is not evidence about who did this or what they ran.

The claim drew immediate scepticism from researchers and users. Startup Fortune quoted researcher Nathan Lambert asking whether "distillation" meant training downstream models "or some other weird shady pattern to use illegally obtained tokens," and quoted a user objecting that "Customer keys breached. Presumably used for distillation? This is not a distillation attack." On Hacker News, commenters pressed the same point — that the framing arrives from a company whose vendors have spent the year arguing that distillation is an existential commercial threat, and that no query logs, no traffic analysis and no attribution have been released. The distinction matters for anyone reading the record later: a credential breach is established; the purpose behind it is asserted.

What changed after the disclosure

OpenCode's instructions to affected users were to revoke and replace every linked provider key through the O​penAI, A​nthropic and G​oogle dashboards, update every application using those keys, and review provider usage and billing for unexpected activity. Startup Fortune reported one further piece of advice in the notice: do not use links in the breach email, but go to the providers' dashboards directly. It also reported that users were told to check billing logs back to 17 October and to set spending limits to cap exposure from a stolen key.

On the Console side, the visible remediation has been revocation and restriction rather than disclosure. Users report keys disappearing from accounts and workspaces being locked; OpenCode has not published what it changed in the legacy system, whether that system is now fully shut down, or how it detected the access. S​tep Security, a security vendor, published response guidance within a day — including the local credential file paths where linked providers are recorded on developer machines — while noting that its tooling can identify CLI installations but cannot determine whether a developer holds a Console account or which providers are linked to it. That limitation is itself a finding: the blast radius cannot be reconstructed from the client side.

What is established, and what is not

Established, on OpenCode's own statements and multiple independent reports: an unauthorized party reached a legacy Console system; third-party provider keys for O​penAI, A​nthropic and G​oogle may have been exposed; roughly 1.4% of Console users, the subset with external providers linked, were notified by email; the company is coordinating with the three providers; A​nthropic revoked affected C​laude keys, per Dealroom; and named users reported unauthorized charges in the hundreds to low thousands of dollars.

Not established: how many accounts 1.4% represents; how the intruder got in; how long they had access; whether every exposed key was used; what the queries were for; whether any data beyond provider keys was taken; what the total loss was; and whether anyone will be reimbursed. OpenCode has not published a post-mortem, and its statement that the incident was "ongoing" has not been formally withdrawn.

The corroboration here is broad but shallow in one specific way. Within 48 hours the disclosure was carried by CyberSecurityNews, OfficeChai, Startup Fortune, Notebookcheck, Dealroom, Cryptobriefing, The420.in, TOKENPOST, FourWeekMBA, BigGo Finance and S​tep Security, and the OECD.AI Incidents and Hazards Monitor lists the event dated 17 October 2026, classifying the harm as Economic/Property and the affected AI principle as robustness and digital security. What that corroborates is that the disclosure happened, that its wording is as reported, and that the financial harm was taken seriously by others. It does not independently verify OpenCode's internal account of the intrusion, because no outlet appears to have obtained one. There is no regulator's notice and no vendor advisory from O​penAI or G​oogle in the record.

How the archive files it

The archive records this as an incident — a realised AI-related event rather than a forecast — with severity high, confidence graded A, real_harm recorded as true, and not disputed. The type tags are CRED and INFRA: a credential compromise of an agent platform's infrastructure. The undisputed flag is about the event, not about the distillation framing; the archive does not treat OpenCode's motive claim as a settled finding, and neither should a reader.

Two things make this record worth keeping beyond its dollar figures. The first is architectural: an agent platform that stores customers' keys to three competing labs on its own servers concentrates risk that would otherwise sit with each customer, and decommissioning a system does not decommission the credentials inside it. The second is evidentiary: the company's own account is a percentage, a legacy system and a motive, with the invoices supplied by users. That is a thinner record than the severity warrants, and it is the shape most of these disclosures still take.

This record sits alongside the other documented agent incidents in the AI incident archive, where each entry carries its own sources, severity, confidence grade and disputed flag.