The company behind the popular open-source AI coding agent OpenCode has confirmed a security breach that exposed the API keys of about 1.4 percent of the users of its hosted Console service, and says the incident was linked to what it calls a large-scale distillation attack. Some affected developers have reported unauthorised charges running into hundreds of dollars on their OpenAI, Anthropic and Google accounts.
.jpg?width=900)
What exactly happened?
OpenCode, built by Anomaly Innovations (formerly known as SST), announced the breach on its official X account at 18:08 UTC on October 17, 2026. In the post, the company said it had "a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users". Affected users received an email that same morning with the subject line "Action Required: Potential provider key breach", and OpenCode said anyone who did not receive an email was not impacted.
Console is OpenCode's optional hosted workspace service. Developers who use it can save their own OpenAI, Anthropic or Google API keys in a workspace so team members can use those models without ever seeing the key. According to the disclosure, the attackers got in through a legacy system that the company says was in the process of being shut down, and the impact was limited to users who had external providers linked to their accounts.
What is a distillation attack and why does it matter?
Distillation is the practice of training a new AI model on the outputs of an existing, stronger one. A distillation attack, in this context, means sending huge volumes of queries to frontier models to harvest their answers and copy their behaviour. Stolen API keys are a cheap way to run that harvesting on somebody else's bill, which is why the symptom many affected users noticed first was unexpected spending, not stolen data.
User reports collected by Notebookcheck showed one developer hit with about $400 in unauthorised charges on an Anthropic account, while another saw roughly 200 euros of Google usage charges and had a project suspended for abuse. Anthropic has been warning about distillation campaigns for months: in February 2026 it said three labs had run more than 16 million exchanges with Claude through roughly 24,000 fraudulent accounts, and on October 12 it said new safeguards had cut the amount of data harvested by distillers by around 90 to 99 percent.
Who was affected, and who was not?
Only a subset of Console users with external providers linked were affected, and OpenCode has not published a total Console user count, so 1.4 percent cannot be converted into a firm number of people. Developers who run OpenCode locally with keys that never touched the Console were not described as affected. The company also has not said how many keys were exposed, how the legacy system was reached, or who carried out the attack.
What is clear is that the incident is still moving. Dax Raad, who runs OpenCode, wrote on X that attackers had been "non stop trying to attack our systems for the past 48 hours", adding that "a side effect is everything is getting hardened".
What should affected users do now?
OpenCode's advice, echoed by security outlets including The Hacker News, is to revoke and reissue the affected API keys directly in each provider's dashboard, not inside OpenCode Console. Users should also review recent usage and billing on their OpenAI, Anthropic and Google accounts for anything they did not run, set spending limits so a stolen key cannot run up an open-ended bill, and update every script, CI job and local configuration that pointed at the old key.
What does this mean for Nigerian developers and startups?
A lot of Nigeria's growing developer community relies on AI coding assistants and pays for frontier models with personal or company API keys. This breach is a reminder that any hosted tool that stores those keys on your behalf is part of your attack surface. The practical lessons are the same whether you are in Lagos or London: keep keys scoped to the smallest set of permissions, cap what they can spend, rotate them regularly, and treat every third-party tool that asks for a key as a decision worth a second thought.
Frequently asked questions
Was the open-source OpenCode tool itself hacked?
No. OpenCode says the weakness sat in a legacy Console system that stored linked provider keys. The open-source agent itself has not been named as compromised.
Do I need OpenCode Console to revoke my keys?
No. Revoke them on the API keys page of OpenAI, Anthropic or Google directly.
Why would attackers steal API keys?
A stolen key to a frontier model lets someone generate large amounts of high-quality training data without paying, and resold AI tokens and keys are also used to run up bills on other people's accounts.
Sources: OpenCode on X (October 17, 2026); The Hacker News (October 19, 2026); Notebookcheck (October 18, 2026); Crypto Briefing (October 17, 2026); Cyber Security News (October 18, 2026).
Related reading: FTC Subpoenas OpenAI And Anthropic Over AI Safety Incidents.
0 Comments