Skip to content
All posts

The OpenCode Breach: Your AI Coding Tool Held Your Provider Keys — and Some Were Drained

api-securitycredential-theftai-securitysecrets-managementsupply-chainopencodedeveloper-securityincident-responsekey-rotationllmopssecurity-leadership
October 18, 2026 · PlayCISO
TL;DR

On 17 October 2026, OpenCode — the popular open-source terminal AI coding agent from Anomaly Innovations (formerly SST) — emailed a subset of users that an intruder reached a legacy system it was decommissioning and may have exposed provider API keys stored in user workspaces. Per multiple outlets reporting the notification email, OpenCode characterized it as a "large-scale distillation attack" affecting roughly 1.4% of OpenCode Console users, said it notified every affected user by email (those who received no email were not affected), and said it is working with the model providers; it could NOT confirm whether exposed keys were actually used maliciously. Separately, developers on X report real fraudulent inference spend on keys used only in OpenCode — one thread cites $281 (OpenAI) + $168 (Anthropic), another $1,700, another ~$400+ — which is the pattern of CREDENTIAL / API-KEY COMPROMISE (stolen keys replayed against the providers), whatever label the attack is given. IMPORTANT FRAMING: PlayCISO is not affiliated with OpenCode and has no inside information; the "1.4%", the email-notification claim and the provider-coordination claim are OpenCode’s own statements as reported by others, not independently verified, and OpenCode has not published a full technical post-mortem. What to do does not depend on the label and is knowable now: if you use OpenCode OR any bring-your-own-key AI tool (75+ providers plug into tools like this), revoke and reissue every provider key, review usage/billing back to at least 17 Oct, set hard spend caps and rate limits on the new keys, prefer short-lived or scoped keys over long-lived ones, stop storing raw keys where a tool can centralize them, and open a provider support ticket for any fraudulent charges. The deeper lesson for security leaders: a BYO-key tool concentrates the blast radius of hundreds of developers’ frontier-model credentials into one target, and a key is a bearer token — whoever holds it can spend your money until you rotate it.

This post references: https://www.notebookcheck.net/OpenCode-hacked-users-urged-to-revoke-their-API-keys.1426957.0.html

If an AI coding tool holds your OpenAI, Anthropic or Google API keys, this one is for you. On 17 October 2026, OpenCode — the popular open-source terminal coding agent from Anomaly Innovations (formerly SST) — emailed a subset of users that an intruder reached a legacy system it was decommissioning and may have exposed provider API keys stored in user workspaces. Developers are reporting real money drained. Here is the calm, accurate version — what is confirmed, what is not, and exactly what to do.

Up front, so there is no confusion

PlayCISO is not affiliated with OpenCode or Anomaly Innovations and was not involved in this incident. This is independent, third-party coverage. Every specific figure below — the 1.4%, the email-notification claim, the provider-coordination claim — comes from OpenCode’s notification email as reported by news outlets, or from public user reports on X. We have no inside information, we have independently verified none of OpenCode’s figures, and OpenCode has not published a full technical post-mortem. Where we draw a conclusion, we say so.

What is reported

  • Who: OpenCode, maintained by Anomaly Innovations (the team formerly known as SST). It is an open-source terminal AI coding agent used with your own provider API keys across 75+ model providers — no markup, you pay the provider directly.
  • What: An intruder reportedly reached a legacy system in the process of being decommissioned. Provider API keys stored in user workspaces may have been exposed.
  • Scope (OpenCode’s figure): Reported as a "large-scale distillation attack" affecting ~1.4% of OpenCode Console users. OpenCode reportedly said it emailed every affected user, and that anyone who did not receive an email was not affected — it was a subset who had external providers linked.
  • Keys named: OpenAI, Anthropic and Google.
  • Real-world impact (user reports): Developers on X report fraudulent inference spend on keys used only in OpenCode — one thread cites $281 (OpenAI) + $168 (Anthropic) starting around 2am Eastern, another $1,700, others $400+. The common thread: other keys the same people hold were untouched, which points squarely at the OpenCode-stored keys.
  • What OpenCode could NOT confirm: whether the exposed keys were actually used maliciously. (The user reports strongly suggest some were.)

Why we call it credential compromise, not a "distillation attack"

"Distillation attack" is the phrase reportedly used in OpenCode’s own email, so we attribute it to them rather than put words in their mouth. But look at the observable facts: provider keys that exist only inside OpenCode are being used to run large volumes of paid inference elsewhere. That is the textbook signature of credential / API-key theft and replay — a stored secret was exposed, and attackers are spending it as a bearer token.

Model distillation — training a cheaper model on a frontier model’s outputs — may well be the attacker’s end goal for all that stolen inference (it is a fast-growing fraud motive: steal keys, generate training data on someone else’s dime). But the breach itself is a secrets exposure. We lead with the mechanism because the mechanism tells you what to fix. This is our read of public evidence, not an official determination.

If you use OpenCode — or ANY bring-your-own-key AI tool — do this now

  1. Revoke and reissue every provider key (OpenAI, Anthropic, Google, and any others) in each provider’s own dashboard — not just inside the app.
  2. Audit usage and billing in each provider console back to at least 17 Oct 2026 for spend spikes or unfamiliar activity.
  3. Set hard spend caps and rate limits on the new keys so the next leak is bounded, not unbounded.
  4. Prefer short-lived, narrowly-scoped keys; delete keys you are not actively using.
  5. Stop centralizing raw long-lived keys — keep them in environment variables or a secrets manager, not pasted into a tool’s workspace.
  6. Open a provider support ticket for any fraudulent charges. Whether providers refund is still unresolved in the coverage, so ask early.

The lesson for security leaders

A bring-your-own-key tool is a credential aggregation point. It pools the frontier-model API keys of every developer who uses it into one system — so a single breach of that system exposes hundreds of high-value bearer tokens at once. That is a blast-radius problem, and it is knowable in advance.

  1. An API key is a bearer token. Possession is authorization; it keeps spending your money until you rotate it. Bound the damage before an incident with per-key scope limits and hard spend caps. Our API Key Lifecycle Lab walks through issuing, scoping, rotating and revoking keys so a leak is survivable.
  2. Inventory where developer AI credentials actually live — CLI tools, IDE plugins, CI secrets, and "legacy systems being decommissioned" (exactly what was reportedly breached here). You cannot rotate what you have not mapped.
  3. Treat the AI supply chain as supply chain. Every tool and MCP server you connect can read or exfiltrate what you hand it. Our Malicious MCP Server Scanner and LLM Threat-Model Generator help you reason about which AI integrations touch your secrets and what they could do with them.
  4. Decommission-in-progress systems are a recurring breach vector. They fall out of patching and monitoring while still holding live data. Put a hard "data purged before shutoff" gate in your decommissioning runbook.

None of this depends on knowing who the attacker was, or on OpenCode’s final post-mortem. The fix for a leaked bearer token is the same every time: rotate it, scope it, cap it, and watch it.

Watch this video

A 45-second breakdown of the OpenCode key-theft incident and the six-step response is on our channel — see the PlayCISO blog and our YouTube for the short.

Sources & credit

Credit to the developers who surfaced this publicly and to the outlets covering it. This post relays their reporting; it does not originate any of OpenCode’s figures.

Developing incident, last updated 18 Oct 2026. We will update if OpenCode publishes an official technical post-mortem. If you received OpenCode’s email, follow its instructions as the authoritative source for your account.

Related articles
A ‘Fleet’ of AI Agents Was Caught Probing Alibaba’s Map Data — What It Means for Agent Security
Researchers at swarmcha.se report that between 28 Sept and 8 Oct 2026, a fleet of internet-connected AI agents running on Tencent Cloud repeatedly tried to extract Amap (Alibaba mapping) data — bypassing anti-bot defences by abusing a public URL-scanning service as a remote browser, and in several cases using exposed API credentials found in public source. Attribution to any specific Tencent team is explicitly uncertain. Here is what was reported, the heavy caveats the authors themselves raise, and what it means for anyone running or defending against internet-connected AI agents.
Operation CAIRN: An Autonomous, LLM-Driven Attack Platform Found in the Wild
A threat researcher reports finding a live, custom-built attack-orchestration platform — "Cairn" — that lets an LLM run intrusions end-to-end with no human in the loop per session: one Docker/Kali container per victim, a fact-graph that remembers what was tried, 229,828 AI-dispatched attack events across 13 days, and a ShellShock-over-SMTP vector that actually landed. Here is what was reported, what is genuinely new (a model reading its own prior work), the IOCs and CVEs involved, and the defences that matter — treated as a single-source disclosure, not yet corroborated by major vendors.
When Your LLM Router Turns On You: Tool-Call Injection and Credential Theft
A defensive brief on a fast-rising risk class: malicious or compromised LLM routers and MCP gateways that inject unintended tool calls, steal credentials in transit, and pivot across hosts. What the attack looks like, why it scales, and the controls that actually contain it.

Ready to practise the decisions these articles describe?

Run a free War Room →
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout
The OpenCode Breach: Your AI Coding Tool Held Your Provider Keys — and Some Were Drained | PlayCISO Blog · PlayCISO