OpenCode breach; AI keys of 1.4% of users at risk

OpenCode, an open-source programming agent maintained by Anomaly Innovations, reported on the evening of October 17 that attackers accessed a legacy system of its hosted Console and may have taken API keys from AI providers stored in customers' workspaces. According to the company's statement released on X, the incident affected 1.4% of Console users and is linked to what OpenCode refers to as a "large-scale distillation attack."

The company stated it identified "unauthorized access to a legacy system that we were in the process of decommissioning." Third-party keys, such as those from OpenAI and Anthropic, saved in the workspace "may have been exposed," according to the notice sent via email to the affected users. OpenCode claims to be working with Anthropic, OpenAI, and Google on remediation and states that the incident is still ongoing. As of the publication of this article, no root cause report, list of indicators of compromise, or absolute number of affected accounts has been released.

What distillation means here

Distillation is training a smaller model using the responses of a larger model. Used without authorization, it requires a large volume: millions of paid calls to a cutting-edge model. Stolen keys solve the cost issue, as the bill falls on the card of the person who registered the key. Users reported on Hacker News unrecognized consumption, and reports cited bills "in the hundreds of dollars" generated by queries that the account holders did not make. One developer reported receiving spending alerts from OpenAI, Anthropic, and Google overnight; only Google suspended the project on its own.

The pattern has documented precedent. On February 23, Anthropic accused three Chinese labs of extracting capabilities from Claude through around 24,000 fraudulent accounts and more than 16 million interactions, according to the company's own report. OpenCode has not attributed the current attack to any group, and nothing disclosed links the case to those accusations. What changes is the vector: instead of creating fake accounts, the attacker used legitimate credentials from paying customers, making detection by providers more difficult, as the traffic originates from accounts with a clean history.

The scope has a clear limit. Developers who use OpenCode solely via the command line, with keys in the local environment, have not been affected, according to the company. The risk falls on those who centralized credentials in the hosted service, precisely the model corporate teams prefer for shared access and cost control.

Where the problem lands

In the United States, the immediate concern is financial and contractual. The keys from OpenAI and Anthropic charge per token, and most organizations do not set a spending cap per key. A key used for distillation can consume a team's monthly budget in just hours. For publicly listed companies, the next question is whether prompts and responses stored alongside the keys contained proprietary code or customer data, which would take the case from the finance department to the risk committee.

In India, the incident comes two days after an official warning about the same type of vulnerability. On October 15, CERT-In issued a critical advisory concerning AI agents as an attack vector, according to coverage by Business Standard and Deccan Herald. The advisory describes agents that reached systems of Indian organizations by exploiting exposed credentials in configuration files, public repositories, and overly permissive cloud roles, and recommends blocking outbound network traffic by default. For consulting delivery centers and multinational GCCs in Bengaluru and Hyderabad that operate AI tools on behalf of global clients, this adds to the 2022 CERT-In rule that mandates incident notification within six hours.

In Brazil, the exposure goes through the same software factories and shared services operations that adopted agent code in 2026. If the workspace stored personal data in prompts, ANPD Resolution 15/2024 sets a deadline of three business days to notify relevant incidents.

The question for the CISO

OpenCode is not an exception. Platforms of agents that store keys from multiple providers in one place have become a single vault for credentials that were previously scattered. The company's immediate recommendation is to revoke and recreate the keys and review recent usage. The more challenging question for those purchasing these tools is: how many third-party services today hold an AI API key from the organization, and how many of them are still running a system that the vendor already planned to shut down.