OpenCode's developer reports a leak of stored OpenAI, Anthropic and Google API keys affecting about 1.4% of console users
Prepared by Sintelligent with the help of SI. Published in SI: . Updated: .
The keys an agent uses to reach models proved a weak point: some users will have to reissue them and check their bills.
Anomaly Innovations, the developer of the open-source coding agent OpenCode, emailed users that after unauthorized access to an old system that was being decommissioned, third-party provider keys (OpenAI, Anthropic, Google) saved in workspaces could have reached outsiders. According to the company, about 1.4% of console users are affected, a subset of those who had external providers linked; the company ties the incident to a "large scale distillation attack" and is working on remediation with Anthropic, OpenAI and Google. Users on social media and Reddit report unauthorized charges (in one case about $400 on an Anthropic account). The company has not confirmed that the keys were used maliciously, and has not disclosed how access was obtained or why the incident was called a distillation attack. Users are advised to revoke and reissue their keys.
Sources 2