OpenCode breach drains users' AI keys as platforms holding customer credentials come under attack
What's the deal? A breach at OpenCodeDealroom has a profile for this one. Try Dealroom → late Friday exposed OpenAI, Anthropic, and other provider keys saved by some users of its paid Console product, the company said Saturday. It put the share of Console users affected at 1.4%, tying the incident to what it called a "large scale distillation attack."
How it works: OpenCode is an open-source coding agent that runs in a terminal, code editor, or desktop app and connects to models from more than 75 providers. Users supply their own private API keys to give the agent access; those keys were exposed. Console stores the keys on OpenCode's servers.
Why it matters: Built by Anomaly (formerly SST), OpenCode's GitHub repository has about 215,000 stars — more than OpenAI's Codex CLI or Google's Gemini CLI. The company says 16 million developers use the agent each month.
What went wrong? An email to affected users said someone gained "unauthorized access to a legacy system that we were in the process of decommissioning." It asked users to revoke keys through each provider's dashboard and monitor accounts for unexpected usage.
The damage: Some users spotted unexplained charges before OpenCode said anything publicly. Colin Parsons wrote on X that his OpenAI key was "pounded" for $281 and his Anthropic key for $168. Preston Zeller put his losses at $1,700, while Francisco Giancarelli saw over $700 in OpenAI usage before pulling the plug.
The response: Anthropic said it revoked affected Claude API keys. OpenCode is working with Anthropic, OpenAI, and Google to remediate. It has not disclosed the number of affected users, total losses, or whether it will reimburse victims.
Not an isolated case: Sharing OpenCode's disclosure, investor Sarah Guo wrote: "that's three companies in the past week." She did not name the other two. Earlier this month, inference platform Fireworks AI disclosed that an unauthorized party had used compromised internal Fireworks credentials to reach environment variables in evaluation jobs for a limited number of customer accounts, capturing API keys and tokens stored as secrets. Fireworks identified the activity on October 6, published a security bulletin on October 9 and told affected customers to rotate the third-party credentials named in their notices. In both cases, the target was a platform holding customers' keys to other services.
The bigger picture: The breach lands amid a wider fight over distillation. In September, US agencies accused six Chinese AI firms, including DeepSeek and Moonshot AI, of extracting billions of tokens from American models, and OpenAI said it shut down a Moonshot-linked campaign in July. On October 12, Anthropic said new defences had cut the data distillers harvest from Claude by around 90 to 99%, describing distillation attacks as industrial-scale campaigns usually run through networks of fraudulent accounts.
Read more: The Latent · OpenCode on X · Sarah Guo on X · Fireworks AI security bulletin · Anthropic
