OpenCode breach may have exposed stored AI provider keys

OpenCode developer Anomaly Innovations warned users that stored API keys may have been exposed through unauthorized access to a legacy console system, Startup Fortune reports. The company linked the incident to what it called a large scale distillation attack and said it affected about 1.4% of OpenCode Console users.

The exposure involved some workspaces connected to external providers, including OpenAI, Anthropic, and Google. Anomaly Innovations emailed affected users on October 17 and said its investigation had found no evidence that other data was exposed.

The company is working with the three providers on remediation. Affected users were advised to revoke and replace their provider keys, review usage and billing records from October 17 onward, and update any services that used the old credentials.

During the incident, the frontier models OpenCode used to investigate the attack began refusing to help because analyzing the attack material tripped their safety filters, according to posts on X by an OpenCode developer and others; the developer said the team has since gained access to a different tool. Investor David Sacks cited the episode, and a similar one at Hugging Face, as evidence that defenders need access to powerful models to run their own cyber defenses.