OpenCode says a breach may have exposed some users' saved OpenAI, Anthropic and Google API keys
The open-source coding agent calls the incident a "large scale distillation attack" that hit about 1.4 percent of OpenCode Console users.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
OpenCode, an open-source AI coding agent that runs in the terminal and lets developers plug in their own API keys from OpenAI, Anthropic, Google and other providers, has disclosed a security breach. According to OfficeChai, the company posted a statement to its community and emailed affected customers, saying it had "identified unauthorized access to a legacy system" that was being decommissioned. It warned that "third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed." OpenCode described the incident as a "large scale distillation attack" affecting about 1.4 percent of OpenCode Console users, and said it had notified all of them individually by email. Users who did not get an email were not affected, the company said. Co-founder Dax Raad said his personal accounts were also being attacked. Security firm Cyera has published an account of the breach with guidance on rotating exposed AI API keys. Anyone holding a stolen provider key can run up charges on the owner's account or reach models under the owner's identity, so affected developers need to revoke and replace keys with each provider rather than only in OpenCode. The incident also shows the risk of tools that collect many third-party credentials in one place.