OpenCode breach hits Console users as exposed API keys trigger unauthorized charges
Anomaly Innovations confirmed that a security breach involving a large-scale distillation attack affected roughly 1.4% of OpenCode Console users, potentially exposing stored third-party API keys.
A security breach at Anomaly Innovations, the creator of open-source coding agent OpenCode, has affected roughly 1.4% of OpenCode Console users and may have exposed their stored third-party API keys, according to Techmeme and a report from Walter Schulze in Startup Fortune. The incident was characterized as a large-scale distillation attack that compromised stored credentials.[1][4]
In a breach notification email sent to users, the company explained that unauthorized access occurred on a legacy system undergoing decommissioning. The email, shared online via Reddit, warned that third-party provider keys stored in user workspaces—such as OpenAI and Anthropic credentials—may have been compromised. Impacted customers were urged to immediately revoke and replace their keys, update connected applications, and check recent usage for unexpected activity.[2]
Users have begun reporting fraudulent API charges in the wake of the incident, including a $400 charge on an Anthropic account. In response, OpenCode is reportedly coordinating remediation efforts with Anthropic, OpenAI, and Google.[2][5]
Key facts
- OpenCode confirmed a security breach impacting approximately 1.4% of its Console users.
- The incident was identified as a large-scale distillation attack.
- Unauthorized access was identified on an OpenCode legacy system that was in the process of being decommissioned.
- Third-party provider keys saved in user workspaces, including OpenAI and Anthropic keys, may have been exposed.
- OpenCode users reported unauthorized API usage following the breach, including a $400 charge on an Anthropic account.
- OpenCode is collaborating with Anthropic, OpenAI, and Google to remediate the breach.
Sources · 5 sources
- TE
Techmeme@TechmemePost on X ·
Anomaly Innovations, behind coding agent OpenCode, says a breach hit ~1.4% of OpenCode Console users and their API keys, in a "large scale distillation attack" (Walter Schulze / Startup Fortune) (Visit Techmeme dot com for the link and full context!)
Open source - CH
Chubby♨️@kimmonismusPost on X ·
OpenCode users are reporting unauthorized API charges after a security breach, including one report of $400 spent on an Anthropic account. OpenCode confirms that at least 1.4% of Console users were affected. Its customer email warns that third-party provider keys stored in workspaces may have been exposed through unauthorized access to a legacy system being shut down.
Open source - CB
Crypto BriefingArticle ·
OpenCode discloses distillation attack that hit 1.4% of Console users The breach highlights the growing need for robust security measures in AI platforms, as attackers exploit vulnerabilities for competitive advantage. The post OpenCode discloses distillation attack that hit 1.4% of Console users appeared first on Crypto Briefing .
Open source - TE
TechmemeArticle ·
Anomaly Innovations, behind coding agent OpenCode, says a breach hit ~1.4% of OpenCode Console users and their API keys, in a "large scale distillation attack" (Walter Schulze/Startup Fortune) Walter Schulze / Startup Fortune : Anomaly Innovations, behind coding agent OpenCode, says a breach hit ~1.4% of OpenCode Console users and their API keys, in a “large scale distillation attack” — A large-scale distillation attack against the company behind the open-source coding agent OpenCode exposed stored OpenAI …
Open source - MT
MTS@MTSlivePost on X ·
SITUATION DETECTED: OpenCode had a security breach last night related to a large scale distillation attack that has impacted 1.4% of console users. They are working with Anthropic, OpenAI and Google to remediate.
Open source