ExplainX analysis

OpenCode, the open-source terminal coding agent, says it suffered a security breach on the night of October 16 to 17, 2026. In a post on X, the project's account described it as "a large scale distillation attack that impacted 1.4% of OpenCode Console users," and said affected users were notified by email: if you did not get one, you were not impacted. The company added that the affected group was a subset of users who had external providers linked.

If you use the OpenCode Console and linked an OpenAI, Anthropic or Google key, check your inbox and your provider billing now. The rest of this post separates what OpenCode has confirmed from what second-hand coverage reports, then gives a rotation checklist you can finish in ten minutes.

Update, October 18, 2026: The story moved overnight. An Anthropic-affiliated post says Claude keys believed to be affected were revoked, users report four-figure bills and a suspended Google project, and OpenCode's lead says their own accounts are now under attack. Details are in What changed since the first report , and the full -steps checklist is split by who you are.

Sources for the incident are thin so far, and the story is still moving. Everything below is labeled as either the maker's own statement or someone else's report. We will add an update section if OpenCode publishes a fuller write-up.

TL;DR: what is confirmed and what is not

What OpenCode actually said

The primary statement is short. OpenCode's account wrote that it had "a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users," that it notified them that morning, and that the impact was limited to users who had external providers linked. It also said it is working with Google, OpenAI and Anthropic to remediate the incident, and describes the incident as ongoing.

That wording matters. "External providers linked" means the Console held credentials for third-party model APIs on the user's behalf. Those are the keys that let anyone spend your money at OpenAI, Anthropic or Google. A breach of that store is a breach of billing authority, not only of an account.

OpenCode has not published a post-mortem, an indicator list, or a count of affected accounts beyond the percentage. The company has said it cannot further details yet.

What second-hand reports add

Small beads escaping a cracked vessel, illustrating the OpenCode breach of stored provider keys

Startup Fortune reports that the maker of OpenCode, Anomaly Innovations (the company formerly known as SST), blamed a legacy console system it was in the process of shutting down, and that stored provider keys tied to OpenAI, Anthropic and Google may have been exposed. It also says some users reported charges on their OpenAI and Anthropic bills before receiving the first notice, without giving amounts, and that the company could not confirm whether the exposed keys had been used maliciously. Per the outlet, the company's investigation to date found no evidence that other data leaked.

Treat those details as reported, not verified. They come from one outlet summarizing the company's statements and user reports.

What changed since the first report

The first 24 hours added five things. Each is labeled by how well it is sourced.

OpenCode's own line is unchanged: the incident is "ongoing," it cannot more, and it is working with Anthropic, OpenAI and Google. Its email, as quoted by security vendor Cyera, attributes the intrusion to a legacy console system the company was retiring. No outlet has confirmed how the attackers got in or how the keys were stored.

The open question: is it really "distillation"?

Nathan Lambert, an AI researcher, put the sharpest question publicly: the public deserves to know whether this is distillation in the sense of collecting outputs to train downstream models, or some other pattern of using illegally obtained tokens. We agree that the word is doing a lot of work.

Anthropic's September report on Chinese labs alleged that roughly 190 million Claude exchanges were harvested, partly through "illegally harvested API keys." That makes the motive plausible, and Cyera draws the same line. But plausible is not proven. Until OpenCode or a provider names an actor and shows evidence, "distillation attack" is the company's label, not a finding. Fast-moving incidents also tend to attract opportunists who resell stolen keys, which looks identical on a bill.

Why "distillation attack" is an odd phrase for a breach

Distillation, in AI, normally means using a strong model's outputs to train a cheaper one. Labs have recently accused rivals of doing it through bulk API access; see our coverage of Chinese labs accused of secretly serving Claude for that side of the story.

Here the phrase seems to describe the motive rather than the break-in. Stolen keys are a way to run large volumes of prompts against frontier models without paying, and the output of those prompts is exactly what a distiller wants. That is consistent with the user reports of unexpected usage, but OpenCode has not said who ran the requests or what they collected. We do not know whether the attacker is a competitor, a reseller, or an opportunist. Do not repeat any attribution you see until a primary source names one.

A vault door with a key beside it, showing why rotating stolen API keys at the provider matters

Do these in order, and do them in the provider dashboards, not through links in any email.

Check whether you were told. OpenCode says only emailed users were impacted. If you linked providers in the Console and got no email, still rotate; it costs nothing.

Revoke and reissue keys at the source. Delete the old key in the OpenAI, Anthropic and Google consoles, create a new one, and name it so you can tell it apart in logs.

Read the usage logs. Look back at least to October 16 for spikes, new models you never call, or traffic at odd hours. Ask each provider's support for a billing review if you find charges you did not make.

Set hard spending limits. Per-key or per-project caps turn a stolen key from an open-ended bill into a bounded one.

Update every place the old key lived. CI secrets, .env files, shell profiles, other agent tools and proxies. A forgotten copy is the usual way a rotated key keeps leaking.

Stop storing provider keys in hosted dashboards when you can. Keep keys in your own secret manager and inject them at run time. If a hosted service needs one, use a scoped, low-limit key made for that purpose.

For the agent security angle, AgentBeam is the agent security platform from the explainx.ai team; it stops AI agents before they take dangerous actions, which complements key hygiene because a leaked key and an over-permissioned agent fail in similar ways.

steps by who you are

The generic rotation list above is the minimum. Here is the same advice sorted by situation, with the order that matters.

If OpenCode emailed you

Do not click anything in the email. Breach notices are prime phishing bait. Open the OpenCode Console and each provider dashboard by typing the address yourself.

Revoke at the provider first. Deleting a key inside OpenCode does not stop someone who already copied it. Revoke in the OpenAI, Anthropic and Google consoles, then create fresh keys with new names.

Check usage back to October 16. Screenshot or export it before you open a billing dispute. Providers ask for timestamps, model names and key IDs.

File billing disputes now. No provider has published a refund policy for this event, so ask early, in writing, and cite the OpenCode incident.

Reset your OpenCode account password and regenerate any Console API keys, then remove providers you no longer use from the Console.

If you linked keys but got no email

OpenCode says no email means not impacted. Rotate anyway. It takes minutes, and the cost of being wrong is an open-ended bill. If you use Claude, note that Anthropic says it revoked keys it believes were affected, so a key that suddenly returns authentication errors is a signal, not a glitch.

If you only run OpenCode locally

Nothing published says locally stored keys were exposed. The reported weak point is the hosted Console. Still, if the same key was ever pasted into the Console, treat it as exposed. Otherwise a rotation is optional hygiene, and the spend cap below is the more valuable step.

Find the exposure. Ask developers whether they used the OpenCode Console, with which providers, and on a company card or email.

Map each key. Note who owns it, what CI jobs and internal apps it, and what data it can reach, such as files, stored responses or fine-tuned models. Rotate in an order that does not break production.

Set caps at the provider. Console budgets only cover spend routed through OpenCode. A stolen key bypasses them, so per-key limits and billing alerts must live in the OpenAI, Anthropic and Google dashboards.

Scope keys per person and project. One key per developer per tool makes the incident a one-line revoke instead of a fire drill.

Move secrets out of hosted dashboards. Use a secret manager and inject keys at run time. AgentBeam covers the adjacent problem of agents taking dangerous actions with the credentials they do hold.

Do not trust social posts claiming a "safe" key list or a rotation tool. Scammers follow every breach.

Do not wait for a refund decision before rotating. Rotation is free; delay is not.

Do not repeat attribution to a named lab or country. No primary source has made one.

Why this one matters beyond OpenCode

OpenCode is one of the most widely used open-source coding agents, and we have covered it from several angles: the complete guide , the 2.0 release , and its recent free-model and Go plan limits . Part of its appeal is that you bring your own keys and pick any model. That flexibility has a cost: whoever holds the keys holds your spend.

Three lessons stand out.

Hosted key stores are high-value targets. A single place that holds many users' provider keys is a better prize than any individual laptop. The OpenCode agent runs locally; the Console is a separate hosted surface. Users who treated them as one trust boundary may be surprised.

Legacy systems are where incidents hide. If the reported cause holds, a system being retired still held live credentials. Shutting something down is a security task, not just a product one: revoke what it stores before you switch it off.

Spend caps are the cheapest defense. Nearly every harm reported so far is a bill. Providers let you cap it, and few people do until a day like this one. We made the same point after the rm -rf incident : agents run with your authority, so limit what that authority can do.

It also fits a pattern of attackers going after developers' AI tooling, such as the fake Codex installer ads that delivered a stealer and the grey-market ecosystem around free Claude Code proxies and their data risks . If you want to harden how your agents handle secrets generally, our Beam CLI security skills guide is a practical starting point.

What people are asking

Do I need to stop using OpenCode?

Nothing published says the local open-source agent was compromised, so there is no evidence you need to uninstall it. The reported problem is a hosted Console system holding linked keys. If you only ever ran OpenCode locally with environment-variable keys, your exposure through this incident looks low, though we cannot rule out details OpenCode has not shared.

Can I trust that "1.4%" means I was safe?

1.4% is the of Console users, not of all OpenCode users, and OpenCode defines the affected group as those who received an email. The number tells you the odds, not your status. Check your email, including spam, and rotate if in doubt.

Will the providers refund fraudulent usage?

We found no statement from OpenAI, Anthropic or Google refunds for this incident. OpenCode says it is working with them on remediation, but nothing has been promised publicly. each provider's billing support with timestamps from your usage logs.

How do I tell if my key was used?

Open the usage page for each provider and look for requests you did not make: unfamiliar models, big token counts, unusual hours, or an IP or region you do not use. Anthropic, OpenAI and Google all show per-key usage, which is why issuing a fresh, separately named key is useful: any traffic on the old name after revocation is a flag.

Is this connected to the other AI-agent incidents this month?

There is no evidence of a link. The common thread is credentials: agents and tools that hold secrets become targets. Treat it as a pattern, not a single campaign.

A fuller OpenCode write-up covering the entry point, the time window, and whether anything beyond provider keys was exposed.

Statements from Anthropic, OpenAI or Google affected keys, abuse detection, or billing relief.

Whether OpenCode changes how the Console stores provider credentials, for example by dropping storage in favor of per-session or bring-your-own-vault flows.

Any named attribution. Until a primary source gives one, treat claims on social media as rumor.

OpenCode has confirmed a breach affecting 1.4% of Console users with linked provider keys, said it notified them, and said remediation with the three big providers is ongoing. Details on cause and scope are still reported rather than confirmed. The action is simple and the same regardless: rotate provider keys at the source, check usage, cap spend, and keep keys out of hosted dashboards where you can.

What is a data breach? Types, examples and first-hour response

OpenCode: the open-source AI coding agent guide

OpenCode 2.0: code mode, background agents and SDK upgrade guide

OpenCode free DeepSeek V4.1 Flash, Zen and Go limits: what is verified

Chinese AI labs accused of secretly serving Claude: the distillation story

Claude Code rm -rf incident and sandbox guide

Fake Codex installer ads and the AMOS stealer

Free Claude Code proxy: terms and data risks

Details are accurate as of October 18, 2026 and may change as OpenCode and the model providers publish more.