Anomaly Innovations, the company behind the open-source coding agent OpenCode, has confirmed a breach that exposed stored API keys for OpenAI, Anthropic and Google on roughly 1.4% of OpenCode Console users. The company emailed affected accounts on October 17, warning that keys saved in their workspaces may have been leaked and urging them to revoke and reissue them right away.
OpenCode is not a chatbot: it is a terminal-based coding agent that runs with a developer's own credentials, reads files, calls external APIs and executes commands. That makes the provider keys users link to their accounts the very thing that keeps the tool working, so a breach reaching the place those keys are stored is a direct hit on developers.
What Anomaly Innovations said about the OpenCode breach
In a short post from its official account, Anomaly Innovations said the incident was "related to a large scale distillation attack" and that only a subset of users who had external providers linked to their accounts were affected. Later reports quoting the company's notice say it identified "unauthorized access to a legacy system" and that third-party provider keys saved in affected workspaces may have been exposed.
The company said it notified every affected account by email the same morning and is working with Anthropic, OpenAI and Google to remediate the incident. It added that it cannot confirm whether the exposed keys were used for anything malicious, only that its investigation "to date" found no evidence other data had leaked, and that it cannot share more details while the incident is ongoing.
Rumors, reports and the dispute over "distillation"
Developers responding to the announcement described their own fallout: one said Google suspended their Google Cloud project afterwards, another said OpenAI deleted their account for breaching its terms because of the incident. These are individual reports on X that could not be verified, and sources also disagree on small details, such as whether the emails went out on the morning of the 17th or the 18th. Reports also say some affected users saw bills climbing into the hundreds of dollars from queries they did not make.
