OpenCode Told 1.4% of Console Users to Revoke Their API Keys After a Breach

OpenCode, the open-source coding agent from Anomaly Innovations, spent October 17 telling a slice of its users to treat their API keys as compromised. Emails with the subject line “Action Required: Potential provider key breach” went to roughly 1.4% of OpenCode Console users, specifically those who had linked external provider accounts, warning that OpenAI, Anthropic, and Google keys saved in Console workspaces may have been exposed through “unauthorized access to a legacy system that we were in the process of decommissioning.” Security researcher Matt Johansen shared the email publicly at 15:30 UTC; the company confirmed the incident on X at 18:08 UTC, attributing it to “a large scale distillation attack.”

The timeline, and the label that raised eyebrows

The disclosure moved fast once it started: user email at midday, public confirmation within hours, and co-founder Dax Raad posting at 18:41 UTC that his personal accounts were under attack as well. But the phrase OpenCode chose, “distillation attack,” immediately drew pushback from security practitioners, because distillation technically means training a model on another model’s outputs, not stealing anything. The charitable reading, laid out in DEV.to’s writeup of the incident, is that attackers used stolen keys to generate frontier-model output at scale, effectively distilling a proprietary model onto their own infrastructure while victims paid the inference bills; some affected users have reported charges in the hundreds of dollars, though OpenCode has not confirmed those reports. The context that makes the label plausible: Anthropic’s September 2026 threat intelligence report documented industrial-scale distillation operations run through proxy networks of fraudulent accounts, and named DeepSeek, Moonshot, and MiniMax as distillation targets earlier this year. Whether that is what happened here is unverified: OpenCode has not explained the attack vector, the dwell time, or whether every exposed key was actually taken, and says the incident is ongoing.

What affected users are being told, and what providers did

The remediation instructions are the standard play, executed with unusual speed by the providers themselves: revoke and replace affected keys in each provider’s dashboard, update every app and CI secret that referenced them, and audit usage going back at least to October 16 for activity you cannot explain. Google confirmed via its team that exposed Gemini keys were proactively blocked and that it is working with OpenCode; the company says it is coordinating with Anthropic, OpenAI, and Google on remediation. Anyone who did not receive the email was not in the affected set, per OpenCode. One gap worth noting: the disclosure addresses Console-stored keys only and says nothing about CLI users whose keys live in local auth.json files, which were not part of the exposed system.

The structural problem this exposes

The uncomfortable lesson sits underneath the incident response. Agent platforms have recreated the exact credential-concentration pattern that security teams spent two decades dismantling: a third-party service storing production secrets for many providers at once, because the product’s value proposition (bring your own key, use any model) requires it. OpenCode’s breach hit a legacy system scheduled for decommissioning, which is the ordinary way these things happen; decommissioning is precisely when monitoring is weakest and access paths are stale. If you run an agent platform or store user keys, the takeaways are concrete: encrypt keys with per-workset envelopes you cannot bulk-decrypt, treat the decommissioning window as heightened-risk with logging to match, and pre-negotiate the provider takedown channel, because Google’s proactive key blocking is what turned a potential slow bleed into a contained incident. And if you are a user, the October 16 floor in OpenCode’s audit advice is a good habit regardless: key-drain attacks are usually discovered days late. The bill-you-for-their-distillation attack model gives thieves a profit motive that plain data theft never had, and this is the first breach we have covered where that incentive is the leading explanation.