OpenCode API Key Breach: What Small Businesses Must Do

On October 17, 2026, Anomaly Innovations — the company behind the open-source AI coding tool OpenCode — warned users it had found unauthorized access to a legacy system it was decommissioning, and that third-party AI provider keys saved in OpenCode workspaces “may have been exposed.” Here is what happened and the ten-minute fix that protects your budget.

What happened

The keys in question are the credentials that let AI coding agents call paid models from OpenAI, Anthropic, and Google. Without them, the agent cannot run; with them, it bills your card for every token it processes.

According to the company’s notice, attackers exploited vulnerabilities in a legacy system to reach keys stored in user workspaces. Anomaly Innovations described the incident as a “large scale distillation attack” — attackers allegedly ran repeated queries against high-end AI models using the stolen credentials, a pattern consistent with collecting model outputs at scale to train or refine a separate, cheaper model.

The company says roughly 1.4% of OpenCode Console users were affected — specifically the subset who had linked external AI provider accounts to their workspaces. It notified every affected account by email the same morning and says it is working with Anthropic, OpenAI, and Google on remediation.

Real-world fallout is already surfacing. Two users have reported unauthorized Claude API usage and about $100 in fraudulent charges, and discussion of the incident passed 850 points on Hacker News within a day.

Scope matters. Reporting so far points to OpenCode Console — the optional hosted layer where teams share model access and budgets — rather than the local CLI, whose keys live on the developer’s own machine. OpenCode has not confirmed that distinction publicly, so treat it as provisional. And note the company’s wording: “may have been exposed” is not the same as “were stolen” — but it is also not “were not used.”

One more catch for anyone relying on built-in safeguards: spending budgets set inside OpenCode Console only cap usage that runs through OpenCode. A stolen key used directly against OpenAI, Anthropic, or Google bypasses those budgets entirely.

Why this matters for small businesses

If your team — or a contractor working for you — uses an AI coding agent, that agent runs with your credentials. Any hosted service that stores your API keys is, in practice, a credential store, and it becomes an attractive target precisely because many customers’ keys sit in one place.

A leaked API key is not just a data risk; it is a billing risk. Someone else can run expensive AI workloads on your account, and the invoice lands on your card. Most small businesses never set spend caps on their AI accounts, so there is no circuit breaker when usage spikes at 2 a.m. In this incident, the affected keys reportedly connected to frontier models — the most expensive endpoints on each provider’s menu.

What to do next: the 10-minute rotation

Do not delete the old key first — that breaks anything still using it. Follow this order instead:

1. Inventory. List every provider key you ever saved in an OpenCode workspace, plus every copy sitting in .env files, CI secrets, shell profiles, and IDE settings.
2. Create the replacement key in each provider’s dashboard. Give it today’s date in the name so old and new are easy to tell apart, and prefer keys scoped to a single project where the provider allows it.
3. Set a spend cap before the new key goes live. Anthropic documents org-level Spend limits, OpenAI offers per-project monthly budgets, and Google AI Studio has a named monthly spend cap.
4. Deploy the new key everywhere the old one lived — local shell, CI, hosting platform — and restart long-running processes, since most read environment variables once at startup.
5. Delete the old key, after confirming one real request succeeds on the new one.
6. Watch usage for 48 hours. Compare daily request counts, daily cost, and the model mix against your normal baseline. Unexplained usage — a large reasoning model on a key you only use for small summaries, or activity in hours nobody worked — is the signal.

Until Anomaly Innovations publishes a post-mortem explaining exactly what happened, do not paste the new key back into OpenCode Console. Use the local CLI with a key from your own environment instead.

If you never saved a key in an OpenCode workspace, this notice does not cover you. Still, rotating API keys on a schedule — roughly every 90 days is a common guideline — remains good practice. The durable lesson is architectural: prefer keys that are scoped, capped, and disposable, so the next breach notice costs you a ten-minute rotation rather than a surprise bill.

Sources

• https://dev.to/akaranjkar08/opencode-console-breach-rotate-your-ai-api-keys-now-2026-5736
• https://startupfortune.com/opencode-breach-exposes-stored-openai-and-anthropic-keys-prompts-urgent-key-rotation/
• https://vectorwire.ai/article/distillation-attack-on-opencode-drains-users-api-keys-for-anthropic-openai-googl-a5ce5a
• https://runtimewire.com/article/opencode-provider-key-exposure-legacy-system