Coding & agents New
OpenCode discloses breach exposing provider API keys of 1.4% of Console users
Published:
OpenCode, the open-source terminal coding agent, said in a post timestamped 18:08 UTC on October 17 (20:08 CEST) that it had a security breach the previous night 'related to a large scale distillation attack' affecting 1.4% of OpenCode Console users. It said affected users were emailed that morning, that users without an email were not impacted, and that only a subset with external providers linked was involved. It described the incident as ongoing and said it was working with Anthropic, OpenAI and Google on remediation.
According to Cyera, whose guide was first published at 6:00 PM ET on October 17, OpenCode's email attributes the intrusion to a legacy console system the company was retiring, and says OpenAI, Anthropic, Google and other provider keys linked in affected workspaces may have been exposed. Cybersecurity News notes that the notice describes possible exposure, not confirmed theft or use of every key, and that OpenCode has not disclosed the entry point, the duration of access or the number of keys.
Dealroom News reports that several users described unexplained charges on X, including one who put losses at $1,700, and that Anthropic said it revoked affected Claude API keys. Those amounts are user claims collected by the publication, not totals confirmed by OpenCode. The 'distillation' label is OpenCode's own description; no public evidence yet shows how exposed keys were used or who was responsible.
Caveat. OpenCode has not published a technical report, an absolute count of affected users or a loss figure, and said it could not share more details while the incident is ongoing. Charges cited are anecdotal user reports. We did not verify Anthropic's revocation statement directly.
Sources