OpenCode Security Violation: Where did the stolen keys go?

Some developers at 17 October 2026 have received the use alert from OpenAI and Anthropic for jobs they are running at all. After a few hours, open-source coding agent OpenCode confirmed that there is a security breach in the Console service it hosts. The company was associated with a large-scale distillation attack. In this article, OpenCode addresses what is corrected in security breach, what the distillation attack is and how stolen API switches are placed in this table.

What Is OpenCode Security Violation?

The first explanation from OpenCode's X account was kept short:

"We have experienced a security breach associated with a large-scale distillation attack at night." (OpenCode, X)

According to the information compiled in Developers Digest Violation affects 1,4% of OpenCode Console users. The affected ones were defined as a subset of users who connect external provider key to the Console and informed 17 October morning by email. Users who do not receive emails according to the company were not affected.

According to the news published in Notebookcheck In the e-mail, the attacker was stated that in the process of closing, the former system has unauthorized access. It was written that third-party switches that are recorded in working areas may be revealed. OpenCode announced that it was worked together with Anthropic, OpenAI and Google. Anthropic also announced that Claude API switches that we thought to be impressed by.

Some questions are still unresponsive. No matter how many keys are leaked, who is behind the attack, and the phrase "breaking attack" did not be explained by the company in which the phrase is fully muscled in this event. The text of the e-mail was not published as an official announcement; the circulating copy is based on the text a user glued to Hacker News.

What is the Difference Between OpenCode Console With Local OpenCode?

OpenCode is an open source coding agent running on the terminal. Developers can connect Claude, OpenAI and Google models with their own API switches. With this direction, reviewed earlier on Masqot AI coding tools between provider independence. The Console is the web-based working area where OpenCode is hosted; teams can store their provider keys here and use them.

The main decisive question for users who are experiencing on what side of the breach. According to analysis published in Redreamality The OpenCode developer noted that the breach is located in the Console, not in the OpenCode itself, and the keys entered in the local use have never reached the company. In the same analysis, it was noted that users did not work anything harmful on the computer.

What is Distillation Attack?

Distillation (distillation) is the name given to the training of a smaller "student" model with the outputs of a large "student". The method itself is legitimate; laboratories produce cheaper versions of their own models in this way. The problem starts when another company’s model is collected to unauthorized and systematically query and train a competitor model.

Anthropic’s announcement published on 23 February 2026 DeepSeek, Moonshot and MiniMax have more than 16 million interactions with Claude over 24,000 fake accounts. In the same announcement, MiniMax was stated that it produces the largest traffic with about 13 million interactions alone. In the goal of campaigns, the agent of Claude had the skills of tool use and coding. Anthropic suggested that this access is provided through proxy services because it does not provide commercial access in China; charges are based on their own detection of Anthropic.

Why Does Shrub API Switches Stop Distillation?

Distillation wants scale, the scale also asks a large number of accounts. As providers close fake accounts, a real key to a legitimate customer becomes more valuable. Anthropic's 10 September 2026 threat report The stolen cards of illegal distillation are told that they are based on fake account networks that are formed with input information and API switches. In the report, thousands of proxy services that are referred to as the "actarma station" are indicated by these methods.

The same report writes the keys were stolen from Anthropic customers’ environments in all reviewed cyber cases. Some of the saldurgans were leaked out the production keys in the cloud environment by applying prompt injection to the tool services using LiteLLM. Shrub provides two things to a key attacker: a difficult use to distinguish, which is mixed with the traffic of the actual owner of the process force and key to another.

The speed limits are also explained in this table why they are insufficient. According to analysis published in WorkOS OpenAI has identified 16,000 extraction requests spread over 4,000 accounts on 24-25 July; average four requests per account. The result that the analysis has clear: not only misuse of the speed limit in each API where the account is cheap, but only control the bill. A single key on a distributed campaign can look like a ordinary use, spending a few hundred dollars per night.

You need to add a warning. The bond between leakage and distillation campaigns in OpenCode is based only on the company’s own expression and not independently verified.

How Much Does Affected Developers Hold Billing?

A exact total number was not shared, but user notifications give an idea about the size of harm. A user that Notebookcheck is transferred, explained unexpected spending on connected AI accounts as $400. A developer included in Redreamality analysis reported that the same night faced with $281 OpenAI and 168 Anthropic fee.

Remarkable detail comes from providers not the OpenCode first of the warning. In the news of Notebookcheck, some users are transferred from OpenAI and Anthropic before OpenCode notification. A public statement has not yet come from the providers that would not be returned for fake use.

How to Reduce Key Risk in Sheltered Services?

When a key is saved on a third-party panel, the security is connected to the weakest system of that service. OpenCode was an old system where the entry point was already close by the company. Practical steps from this event are:

1. If the provider key has been saved to the Console, the email should be renewed directly from the provider panel without expected.

2. OpenAI, Anthropic and Google panels have to define the limit and usage alert; it gave first alarm providers in this event.

3. A separate and authorized narrow switch should be used for each vehicle; sharing the same switch on multiple services is growing the effect of leakage.

4. Keys in local use should not be written into the code store but environment variables.

How to apply to autonomous systems of the minimum authorization principle, at Masqot AI agent safety in detail. If the measures to be taken against the pests that are logged in on the device side AI account security was discussed in the article. The point that distinguishes the OpenCode case is that the switch is not from the user’s device, but from a trusted service server.

What does the community think?

The incident sat quickly on the developer community. Based on Redreamality analysis "OpenCode Hacked in Hacker News: User ID leaked" header The same day reached 854 points and 159 comments. The top interpretation of the header left the separation statement between the Console and the terminal version. Some users mentioned up to 1.700 bills in shares on X.

A part of the organization turned to the company’s chosen language. Developers Digest noted that the phrase "breaking attack" means what it means in practice in this event. The opinion that the main problem in discussions is not the purpose of the attacker, but the provider switches are stored in a hosted system.

The distillation itself is also controversial. According to the news published in GovInfoSecurity Anthropic and OpenAI argued that the adoption of Meta CEO Mark Zuckerberg in the manifestos of the US will help maintain the AI leadership. While a party sees the distillation as an intellectual property and national security issue, the other party counts him a usual part of machine learning.

Frequently Asked Questions

Does OpenCode use change API keys?

Yes if the provider key is saved to the Console. Developers Digest recommends renewing these keys from the provider panel even if they don’t come to email. For those who only use the local version, the company has not reported an impact, but regular key renewal is a good habit in any situation.

Are Local OpenCode users affected by breach?

No according to company description. OpenCode developer noted that the breach is experienced in the hosted Console service and the keys entered in the local use have not reached the company.

Is the model distillation illegal?

Distillation is not a illegal method alone; laboratories are regularly using to minimize their own models. Anthropic and OpenAI are a violation of the use conditions of unauthorized distillation of models. Meta since its wider adoption of distillation.

Are fake API bills returned?

There is no open provider policy yet to the public. Anthropic cancels the affected Claude keys, but the return process was not disclosed. In case of unforeseen spending, it is necessary to apply to the support team of the respective provider.

Are OpenCode Zen and Go users affected?

This question has not yet been answered clearly. The description of OpenCode mentions only external provider-connected Console users; a separate information was shared for Zen and Go subscriptions.

OpenCode is expected to publish an official report with details of the event. The identity of the saldurga will not be seen all of the table without clearing how the leaking number and distillation connection was established. The question of where and how coding agents hold their provider keys came to be the problem of a single company with this event.