OpenCode API Key Breach (October 2026): What Happened to Developers' OpenAI and Anthropic Keys and How to Rotate Them Safely

I woke up this morning to a notification no developer wants: "Action Required: Potential provider key breach." It was from OpenCode, the open-source AI coding agent I run in my terminal, and it said the API keys I'd trusted it with — OpenAI, Anthropic, Google — might be in someone else's hands. If you've ever pasted a provider key into OpenCode Console, this one's for you: everything reported about the breach so far, the full timeline, and exactly what to do today.

What OpenCode is, and why this breach stings

If you're new to it: OpenCode is an open-source, terminal-based AI coding agent built by Anomaly Innovations (the company formerly known as SST). You run it in your terminal, and it works with your own credentials — it reads your files, calls external model APIs, and executes commands on your behalf. The provider keys you hand it aren't a convenience setting; they're the fuel that makes the tool work. No key, no models.

That design is exactly why this breach hits different. The OpenCode docs already warn that the tool "does not sandbox the agent," and that its permission prompts are "a UX feature" rather than a real security boundary — the docs recommend Docker or a VM for genuine isolation. Those warnings were about the agent going rogue on your own machine. Nobody warned us the keys could walk out the back door of a company system we never knew was still running.

What happened, according to the reports

On October 17, 2026, Anomaly Innovations began emailing OpenCode users with an unambiguous subject line: "Action Required: Potential provider key breach." The company confirmed unauthorized access to a legacy console system it was in the process of decommissioning — a system it was shutting down, but hadn't shut down yet.

The keys at risk are the provider keys saved in OpenCode Console workspaces: OpenAI, Anthropic, and Google. Roughly 1.4% of Console users were affected — the subset with external providers linked. OpenCode hasn't published a Console user count, so the percentage can't become a headcount, but if you got the email, you were in the group.

What makes this incident unusual is the motive. Anomaly Innovations described the intrusion as a "large-scale distillation attack." The attackers weren't after passwords or payment details — they were after billable access to frontier models. Once they had the keys, they ran repeated high-volume queries against high-end models to collect input-output pairs for training or refining a cheaper model. In other words, a stolen API key is free training compute for whoever holds it. This is the first widely reported breach where the stolen asset wasn't data — it was the ability to spend someone else's money on AI inference.

The timeline — and the uncomfortable 22 hours

Here's the hour-by-hour reconstruction. Note that it came from a developer posting as zephel01, not from the company:

• ~00:30 UTC, October 17: the earliest exposure the company could identify. This is when the window opened.
  
• ~22:51 UTC, October 17: the first notification email went out — roughly 22 hours after the exposure began. Twenty-two hours is a very long time to hold a live API key that someone else may already have.
  
• Just before 01:00 UTC, October 18: a second email followed.
  
• 14:14 UTC, October 18: word of the breach surfaced publicly on the r/opencode subreddit as users compared notes.
  
• 17:56 UTC, October 18: the company's public statement landed.
  

At the time of writing, the company's status page, changelog, and website carried no advisory at all — the only notice went by email, to accounts it had already identified as affected. If you weren't on that list, nobody told you. I find that worth saying plainly: a developer community reconstructed the timeline faster than the vendor published one. That's not how trust is built.

The real damage: bills people didn't authorize

Security incidents get abstract fast, but this one arrived as dollar amounts. Here's what's been reported by users publicly:

• Three public accounts of unauthorized charges added up to roughly $449, over $700, and $1,700 in provider spend.
  
• Developer Max Weinbach reported that his OpenAI account recorded about 35 million tokens across 8,966 requests during the prior day, leaving his prepaid balance at negative $2.15. He also said Google warned that one of his projects might be compromised and temporarily reduced its usage limit or rejected API calls.
  
• One user reported $400 in unauthorized charges on an Anthropic account. Another said Google usage charges had reached around €200 and their project had been suspended for excessive abuse.
  
• One commenter said they received usage alerts from both OpenAI and Anthropic before OpenCode notified them.
  

Anthropic told Dealroom it had revoked the affected Claude API keys, which is at least a clean kill switch. But here's the cold part: no provider has said it will refund fraudulent usage. The money spent by attackers through your key is, at the moment, your problem.

For its part, OpenCode says it cannot confirm whether any exposed keys were actually misused, and that its investigation so far found no evidence of other data leaking. Fair enough — but two users reporting unauthorized usage before the company said anything publicly tells its own story.

How to respond right now: the developer checklist

I've been through key rotations before (who hasn't leaked an AWS key to a public repo at least once?), and the drill is always the same. If you ever saved a provider key in an OpenCode workspace, do this today:

1. Revoke each key at the provider's own dashboard. Go directly to the OpenAI, Anthropic, or Google Cloud console yourself — do not click through links in the notification email, however legitimate they look. Phishing always surfs the wake of real incidents.
2. Reissue new keys, and update every consumer. Every script, CI job, side project, and local .env that used the old key needs the new one. Miss one and you'll be debugging mysterious 401s at midnight.
3. Confirm the old key is dead. Make a request with the old key and verify it returns HTTP 401. Don't assume — verify.
4. Review billing and usage logs back to October 17. Look for spikes in token usage, unfamiliar request patterns, or model calls you don't recognize. If you see fraud, document it — screenshots, timestamps, request counts.
5. Set spending limits and usage alerts. Every major provider lets you cap monthly spend and alert on anomalies. If you didn't have these set before, this is the week.
6. If you didn't get the email, you're reportedly fine — but rotate anyway if the key was valuable. Key rotation is cheap; incident response is not. Keys you added to the local CLI with /connect were never part of this incident.

One critical detail worth repeating: removing a key from OpenCode does not invalidate copies already taken. The stolen copy lives on the attacker's machine, not in OpenCode's database. Rotation at the provider is the only thing that kills it.

The bigger lesson: your API key is now a bank account

Here's the part I keep coming back to. For years, we treated API keys as secrets — things to keep out of git, out of screenshots, out of Slack. That mental model is still right, but it's incomplete. An AI provider key is not just a secret; it's a payment instrument with a practically unlimited line of credit. Whoever holds it can convert it directly into compute spend — thousands of dollars per day — with no further authentication and no fraud department calling to check.

This isn't theoretical. Reports noted that a pentest tool called MONST3R-AI was tracked across 16 forums between February and August 2026, running on stolen API keys from OpenAI, Anthropic, and Google accounts. There's an active ecosystem that treats your keys as infrastructure. Act like it.

What does that mean in practice? A few habits I'm tightening up after this week:

• Least privilege, always. If a provider supports scoped keys (restricted models, rate caps, IP allowlists), use them. A key that can only call one cheap model from your office IP is a much smaller blast radius than a god-mode key.
  
• Separate keys per tool. Your coding agent, your side project, and your CI pipeline should not share a key. When one leaks, you revoke one key — not your entire stack.
  
• Never store keys in third-party workspaces unless you have to. OpenCode Console is an optional cloud gateway that lets teams share provider keys without seeing the credentials. Convenient — and now we know the failure mode. Local keys via /connect were untouched by this incident. That contrast speaks for itself.
  
• Sandbox your agents. OpenCode's own docs tell you the agent isn't sandboxed and permission prompts are UX, not security. Run coding agents in Docker or a VM, especially when they hold your keys and your filesystem.
  
• Treat decommissioning as a security event. The breach came through a legacy system the company was shutting down. "Almost turned off" is not "turned off." Every team has a zombie service somewhere; this week is a good time to audit yours.
  

Conclusion: the trust model changed this week

I've used enough developer tools to know that every one of them asks for trust — with our code, our credentials, our infrastructure. The OpenCode breach doesn't mean AI coding agents are finished; the productivity gains are real, and I'll keep using them. But it changes the trust model. A vendor holding your provider keys is a vendor holding your wallet, and this incident showed the full chain of what can go wrong: a forgotten legacy system, a 22-hour notification gap, a community-built timeline, and bills landing on developers who did nothing wrong.

Rotate your keys today. Scope them tomorrow. And the next time a tool asks to hold your API key in its cloud, ask whether the convenience is worth the blast radius — because this week, we all saw the blast radius.

FAQ

Was I affected by the OpenCode breach?
If you received the "Action Required: Potential provider key breach" email from OpenCode starting late October 17, 2026, yes — you were in the roughly 1.4% of Console users with linked external providers. The company says users who got no notice were not affected.

Which API keys were exposed?
Provider keys for OpenAI, Anthropic, and Google that were saved in OpenCode Console workspaces. The company's email named OpenAI and Anthropic as examples. Keys added to the local CLI via /connect were never affected.

What should I do if I got the email?
Revoke and reissue every affected key in each provider's own dashboard (not through links in the email), update every tool and script that used the old key, confirm the old key returns HTTP 401, and review billing and usage logs back to October 17. Set spending limits and anomaly alerts if you haven't already.

Will I get refunded for unauthorized charges?
As of October 18, no provider has confirmed refunds. Anthropic told Dealroom it revoked the affected Claude API keys. Document any unauthorized spend with screenshots and timestamps, and contact your provider's support — but don't count on automatic reimbursement.

What is a "distillation attack"?
It's an attack where the goal is to collect massive numbers of input-output pairs from a powerful model so the attacker can train or refine a cheaper model that mimics it. Your stolen API key becomes free training compute — which is why the attackers ran high-volume queries instead of stealing data.

Is OpenCode itself still safe to use?
The company says the intrusion came through a legacy console system it was decommissioning, and that it's working with Anthropic, OpenAI, and Google on remediation. The open-source CLI itself wasn't the attack vector. Still, prefer local keys via /connect over cloud-stored workspace keys, and run the agent sandboxed in Docker or a VM per the project's own documentation.