OpenCode breach exposes developer API keys following distillation attack

Anomaly Innovations emailed OpenCode users on October 17, 2026, to report a security breach that exposed stored OpenAI, Anthropic, and Google API keys. Startup Fortune, FourWeekMBA, and OfficeChai all reported that the incident impacted approximately 1.4 percent of OpenCode Console users. The breach forced an urgent round of key rotations across the affected developer community. [1][2][3]

Startup Fortune reported that the incident was related to a large-scale distillation attack against the company behind the open-source coding agent. Anomaly Innovations, the firm formerly known as SST, confirmed the breach from its official account. The company stated that it notified every affected account by email on the morning of October 17, and that the leak impacted a subset of users who had external providers linked to their workspaces. [1]

OpenCode features a model-agnostic architecture that supports over 75 large language model providers, including local models, Claude, GPT, and Gemini. More than 2.5 million developers use the tool monthly. The platform emphasizes privacy-focused workflows that avoid storing code or context data. [7]

Startup Fortune reported that Anomaly Innovations urged affected users to perform immediate key revocation for exposed credentials. Security teams using the platform must rotate their linked OpenAI, Anthropic, and Google API keys to prevent unauthorized access to third-party language model providers. [1]