By Hamza Faisal

OpenCode, the open-source terminal-based AI coding agent that lets developers plug their own API keys from OpenAI, Anthropic, Google and other providers into a single tool, has disclosed a security breach that may have exposed those credentials.

In a statement posted on October 17, 2026, and in emails sent to affected customers, OpenCode said it had "identified unauthorized access to a legacy system" that was in the process of being decommissioned, and that "third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed."

The company is describing the incident as a "large scale distillation attack" that impacted roughly 1.4 percent of OpenCode Console users, and says it has notified everyone affected individually by email. Its message was blunt: if you did not get an email, you were not among those impacted — only a subset of users who had external providers linked were hit.

The keys were the target, and the bill was the weapon

The attackers were not after passwords or credit cards. A stolen provider key can authorize requests against the victim's account, drain prepaid credits, and rack up billable usage on the most expensive AI models in the market — the cost of using frontier models landing on the developer who was hacked.

Affected users reported their account balances draining quickly, with some bills climbing into the hundreds of dollars. The company has shared limited technical details so far, saying only that "the incident is ongoing so we cannot share more details at this point," and that it is working with Anthropic, OpenAI and Google on remediation.

The name OpenCode gave the incident is itself revealing. A distillation attack probes a proprietary model through repeated, targeted API queries to capture its outputs — effectively copying its behavior into a smaller model on the attacker's hardware. With stolen keys, the attacker runs the whole operation on someone else's quota and billing.

A legacy system left online too long

The breach did not hit OpenCode's main infrastructure. The company says the unauthorized access was to a legacy system that was being shut down — the kind of server nobody thinks about until it becomes the one that gets broken into.

The disclosure spread fast. A screenshot of the customer notice surfaced on Reddit's r/opencode community on October 17, and security researcher Matt Johansen amplified the warning the same day, telling OpenCode users to rotate their keys immediately. The story was also trending on Hacker News with hundreds of upvotes.

What OpenCode users should do now

OpenCode is asking affected users to revoke and replace their keys through the relevant provider's dashboard, update any applications using them, and review recent usage for anything unexpected. The notification does not say how many accounts were affected in absolute numbers, how long the access lasted, or how the intruder got in — details the company says will have to wait until the incident is contained.

The incident is also a wider warning for the AI tooling ecosystem. Coding agents increasingly sit between a developer's projects and paid model APIs, holding credentials for convenience. One compromised tool can turn into a security incident and an unexpected bill at the same time — and the bill can arrive before anyone notices.

By Hamza Faisal