- Anomaly Innovations, maker of OpenCode, says a legacy system may have exposed OpenAI, Anthropic and Google keys for about 1.4% of Console users.
- The company calls it a distillation attack, but has not explained how the keys were obtained. Some users report unexpected charges.
- Rotate keys through provider dashboards, review billing since October 17, set spending limits, and ask vendors which old systems still hold your credentials.
When you give an agent your keys, you inherit its vendor's least-maintained system
A coding agent is only useful because of what it can reach. OpenCode runs in a developer's terminal with the developer's own credentials. It reads files, calls outside services and runs commands. The API keys for AI model providers are what let it work.
That is why this week's incident matters beyond one tool. The lesson here is simple. A key you hand to an agent is only as safe as the oldest, least-maintained system its vendor still runs. Your own careful habits cannot make up for that.
What the company has said
Startup Fortune reports that Anomaly Innovations, the firm behind OpenCode, sent users a warning email on October 17. The notice said the company had "identified unauthorized access to a legacy system". It added that third-party provider keys, such as OpenAI and Anthropic keys, saved in a workspace "may have been exposed."
According to the company's statement as reported, about 1.4% of OpenCode Console users were affected. Only users with external providers linked to their accounts were included. The company says it is working with Anthropic, OpenAI and Google, and that the incident is ongoing.
Why a vendor-side key store is a single point of failure
Tools that store provider keys on the vendor's side, as OpenCode's Console appears to, create a vault. If an attacker reaches the vault, the keys inside could leave with them, whatever the user did on their own laptop.
Startup Fortune notes that OpenCode's own documentation says it "does not sandbox the agent". Its permission prompts are described as "a UX feature", not a security boundary. That advice protects a user from the agent. It does not protect keys stored in the vendor's systems.
The company calls the event "related to a large scale distillation attack". Distillation means training one model on another model's answers. In an attack, that would mean sending huge numbers of queries to copy a model's behavior. Exposed keys would be one way to pay for that.
That label does not say how the keys were obtained. Researcher Nathan Lambert argued that the public should be told whether the word means model-training distillation or a different pattern built on illegally obtained tokens.
Startup Fortune suggests both could be true. An intruder may have reached the old system, then used the keys at volume. The company has not confirmed that order of events.
Some users are already counting the cost
According to its message to users, the company could not say whether anyone had misused the exposed keys. It said its investigation so far had found no sign that other data leaked. Startup Fortune reports that some users saw bills "climbing into the hundreds of dollars" from queries they did not make. Some said the charges appeared before the first notice arrived.
Some developers also posted that a Google Cloud project was suspended and that an OpenAI account was deleted. Startup Fortune says these are individual reports on X that it could not verify. It also notes that sources disagree on small details, such as whether emails went out on the 17th or the 18th.
For a solo developer, rotating keys is a chore. For a small team it is larger. Every pipeline, CI job and teammate setup that used the old key has to change.
What the company has not said
Startup Fortune lists several open questions. The company has not given the number of accounts behind the 1.4% figure. Beyond "a legacy system", it has not explained how attackers got in or when it first detected the access.
Users also asked whether keys held in local configuration files, outside the Console, were at risk. There is no answer yet.
Withholding details while an investigation runs is understandable. Customers are still left to judge their own exposure without the facts.
What leaders and teams should do
First, replace the keys. Cancel each OpenAI, Anthropic and Google key and issue a new one by logging in to each provider's own dashboard. Do not use links in the breach email. Then review billing and usage logs back to October 17, and set spending limits so an exposed key cannot run up an open-ended bill.
Then put these questions to your team and your vendors:
Where does each AI tool store our keys: on the vendor's servers or only on our machines? Which keys are shared across tools and people? Could we give each tool its own key, with a low spending cap? What older systems does a vendor still run, and when are they shut down?
An old system that is being decommissioned still holds live credentials until someone removes them. A forgotten back door can still open onto the room where your keys are kept.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Startup Fortune.
