OpenCode Breach: Hackers Stole API Keys to Burn Other People’s AI Bills

Most breaches steal data. This one stole compute. On October 17, 2026, OpenCode, the popular open-source AI coding agent built by Anomaly Innovations, disclosed that attackers had gained unauthorized access to a legacy system it was decommissioning, and that third-party AI provider keys saved in some users' Console workspaces may have been exposed.

The company described the incident as a "large-scale distillation attack" affecting about 1.4 percent of OpenCode Console users, specifically the subset who had linked external providers. The keys in question belonged to OpenAI, Anthropic, and Google, and because API keys authorize billable requests, whoever held them could run queries against frontier models at the victims' expense.

Affected users got an email on the morning of October 17 with the subject "Action Required: Potential provider key breach." It said someone had gained "unauthorized access to a legacy system that we were in the process of decommissioning," and that keys "saved in your workspace may have been exposed."

Why attackers wanted keys, not passwords

This is the part that makes the breach genuinely novel. The attackers were not after passwords, payment details, or personal data. They were after access to expensive AI model endpoints. With a stolen Anthropic or OpenAI key, you can burn through hundreds of dollars of model inference in hours, which is exactly what victims reported. Public accounts described unauthorized charges of roughly $449, more than $700, and $1,700 on provider accounts.

The "distillation" framing points to the likely objective. Model distillation is the practice of collecting a powerful model's responses at scale to train or refine a cheaper model. An attacker holding someone else's keys gets free training data: every query the victim pays for produces outputs the attacker can use to build a competing model. It is theft that finances its own research and development.

OpenCode co-founder Dax Raad posted on October 17 that his personal accounts were also being attacked, writing "whole new world with ai powered hacking." That personal detail underlines how new this class of attack still is: the first widely reported breach where the stolen asset was not data but billable access to frontier models.

What OpenCode did and did not disclose

The company says it notified all affected users individually by email, and that users who did not receive an email were not impacted. Keys added to the local CLI with the /connect command were never part of the incident; only keys saved in hosted Console workspaces were exposed.

OpenCode has not published its total Console user count, so the 1.4 percent figure cannot be converted into a number of people. It has not disclosed the number of keys involved or whether exposed keys were misused beyond the victim reports. It has not provided further technical details, saying "the incident is ongoing so we cannot share more details at this point." The company says it is working with Anthropic, OpenAI, and Google to remediate.

The remediation picture is mixed. Anthropic told the publication Dealroom it had revoked the affected Claude API keys. But no provider has publicly said it will refund fraudulent usage, which leaves victims holding bills for compute they never ran. Some users also reported login problems on the Console service after the disclosure, with social sign-in returning errors.

What to do if you are an OpenCode user

If you received the "Action Required" email: revoke each potentially exposed key at the provider's own dashboard, not inside OpenCode. Reissue new keys, update every application that consumes the old keys, and confirm the old key now returns an HTTP 401. Then review recent usage on your provider accounts for spend you do not recognize, and set up usage alerts and spending caps where the provider supports them.

If you did not receive the email, OpenCode says you were not affected. But the incident is a good prompt for everyone who pastes API keys into cloud-hosted tools: prefer local credential storage, keep keys scoped to the minimum permissions, rotate them regularly, and treat any service that holds your provider keys as a high-value target. It is one now.

The broader lesson extends beyond one coding tool. As AI usage becomes a line item on company budgets, API keys have become financial instruments. Attackers have noticed. Every team that hands frontier-model keys to a third-party platform should be asking what happens when that platform's legacy infrastructure becomes the front door.

Frequently Asked Questions

What is a distillation attack?

In this context, it refers to attackers running large numbers of queries against powerful AI models to collect their outputs, which can then be used to train or refine a cheaper model. OpenCode used the term to describe the large-scale attack tied to its Console breach.

Was my OpenCode account affected by the breach?

OpenCode says it emailed everyone affected individually. If you did not receive the "Action Required: Potential provider key breach" email, the company says you were not impacted. Keys stored locally via the CLI's /connect command were never part of the incident.

What should I do if I received the breach email?

Revoke each key through the provider's own dashboard (OpenAI, Anthropic, Google), generate replacements, update every app using the old keys, confirm the old keys return errors, and review your provider accounts for unexpected usage or charges.