OpenCode confirms breach: a 'large scale distillation attack' stole provider API keys from 1.4% of Console users

• Who: OpenCode, the open-source AI coding platform/agent; co-founder Dax Raad confirmed the breach on October 17, 2026.
• What: unauthorized access to a legacy system that was being decommissioned, tied to what the company calls a "large scale distillation attack".
• Scope: about 1.4% of OpenCode Console users — specifically a subset who had linked external providers (OpenAI, Anthropic, Google) in their workspaces.
• At risk: third-party provider API keys saved in those workspaces; OpenCode says it cannot yet confirm whether exposed keys were used.
• Remediation: affected users were emailed October 17 and told to revoke and replace their keys; OpenCode is working with Anthropic, OpenAI and Google.
• Real-world impact: some affected users reported unauthorized charges running into the hundreds of dollars (a $400 Anthropic bill and ~€200 in Google usage surfaced in user reports).

OpenCode, the open-source AI coding agent, confirmed on October 17 that it had been breached. Attackers gained unauthorized access to a legacy system and may have walked away with something more valuable than user data: the OpenAI, Anthropic and Google API keys saved in the workspaces of roughly 1.4% of its Console users.

The disclosure came in a post from OpenCode's official account: "We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users." The company said it had notified every affected user by email that morning, adding: "If you did not get an email you were not impacted, it was a subset of users who had external providers…" — the accounts hit were those with third-party provider keys linked to their workspaces.

A decommissioned legacy system was the way in

In the emails, OpenCode said it had "identified unauthorized access to a legacy system" that was already in the process of being decommissioned, and warned that "third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed." The company is working with Anthropic, OpenAI and Google on remediation — and cautions that "the incident is ongoing so we cannot share more details at this point."

Even OpenCode co-founder Dax Raad said he was caught in the blast radius, posting that his "personal accounts are being attacked now too" — "whole new world with ai powered hacking."

They weren't after passwords — they wanted the queries

According to the company, the attackers exploited the legacy system to reach API keys connected to models from Anthropic, OpenAI and Google. With the keys in hand, they ran repeated queries against high-end models. Some affected users reported their account balances draining fast, with bills climbing into the hundreds of dollars — including a $400 unauthorized Anthropic bill and about €200 in Google usage reported by users.

That profile is what makes OpenCode call this a "distillation attack": the objective appears to be harvesting large volumes of high-quality model outputs to train competing models, with the victims footing the compute bill. It's an AI-specific breach category — the stolen asset wasn't stored user information but the ability to make huge numbers of frontier-model queries on someone else's dime.

OpenCode also said it cannot yet confirm whether the exposed keys were actually used, and that its investigation "to date" had found no evidence that other data leaked. The command-line tool and its source code were not reported as compromised — the tool is open source and runs on your own machine — but for these users, the keys were sitting in someone else's console.

What to do if you use OpenCode

If you didn't get an email, OpenCode says you weren't impacted. If you did, revoke and reissue every provider key linked in your Console workspace in that provider's own dashboard, review recent usage and bills for anything unexpected, and set spend limits where the provider allows them. The same advice applies to anyone who pastes API keys into hosted AI tools: an exposed key is not a leak of who you are — it's a leak of what you can pay for.