Stolen API keys, bills of up to $1,700: 48 hours inside the OpenCode Console breach, where even the defenders' AI refused to help

What happened? Stored keys were taken in bulk

Hi, Haru Misaki here. Today's story is a stomach-churner. Anomaly Innovations, the company behind the coding agent OpenCode, announced a breach on October 17 on its official X account. Someone gained unauthorized access to an old system that was being decommissioned, and API keys for three companies — OpenAI, Anthropic and Google — stored in user workspaces may have leaked. An API key is a string that works like a password for calling an AI service. Anyone who holds yours can run AI on your dime as much as they like.

About 1.4% of Console users were affected. The same day, October 17, the company emailed affected users and asked them to revoke their keys. It blamed "a large-scale distillation attack" and said it was working with the providers, but that it could not share details "because the incident is ongoing."

First, the key question is what was actually breached. It was OpenCode Console, the hosted service, which runs on the company's servers and where users store their keys. It was not the open-source CLI that most people run in their terminals. According to an analysis by redreamality.com, keys used with the local CLI never reach the company's servers in the first place. So no, this does not mean everyone who uses OpenCode is compromised. That part matters 💡

Two emails on the same morning: victims and their bills

Most of the discussion happened in a Hacker News thread titled "OpenCode Hacked: User credentials leaked", which drew 942 points and 174 comments, including posts from victims themselves. I read all of them, and it wasn't easy 😢

verbo_villain said that on the same morning OpenCode's breach notice arrived, an email from Anthropic also arrived saying they had used up their $20 in API credits. Waking up to a warning and a billing notice side by side is terrifying. weknowbetter wrote that their key was revoked in the middle of a working session at 05:15 UTC on October 18. lifeisloving said they were double-charged when trying to cancel and had all their OpenCode keys revoked, and accused the company of "trying to downplay the incident."

As for the amounts, they have been reported in a post on X by Mark Kretschmann and in a HuggingNews roundup. One person was charged $281 on OpenAI and $168 on Anthropic. Another was charged $1,700. A third ran up more than $700 in OpenAI usage before revoking the key. Reported losses range from roughly $168 to $1,700. At least one OpenAI account was reportedly suspended for violating the terms of service. Someone else used the stolen key, yet it's the owner who gets suspended — that's brutal. There is also a report of a Google Cloud project being suspended, but it has not been confirmed. OpenCode has yet to disclose the number of victims, the total losses, or whether it will compensate them.

Is "distillation attack" really the right term? Complaints about thin disclosure

The term itself was the most debated point. Distillation is a technique in which you send a powerful AI model a large number of questions, collect its answers, and use them as training material to cheaply build another model. Using a powerful model costs money, so stealing other people's keys lets an attacker gather that training data while someone else pays the bill.

But on HN, people quickly pushed back: "Doesn't that just mean the keys were stolen and then used for distillation?" The criticism is that the core of what happened is a key leak, and calling it a "distillation attack" makes it sound like a large outside attack and blurs the issue. I get that. What users want to know is not the attack's name but when and where their keys leaked 🤔

There was also strong frustration over the lack of detail. pranshuchittora wrote that the company "should publish a detailed root-cause analysis," and verdverm said it "should release the original queries as public data so they can be verified externally." Complicating matters, OpenCode itself says it has not been able to confirm whether the leaked keys were actually abused. Users keep reporting charges, yet the company says it can't confirm misuse. I understand that some things can't be discussed mid-incident, but honestly, I wish it had at least shared the scope of the damage and its compensation policy up front.

48 hours in which the defenders' AI, too, said "I'd rather not…"

This was the part that made me think the most. An OfficeChai article quotes a post on X by co-founder Dax Raad, in which he reportedly wrote that "we've been under constant attack for the last 48 hours." He added that "we need agents running 24/7 just like they do." Attackers use AI that never sleeps to hammer away nonstop, so defenders want an always-on agent too — one that keeps watching even after you close the chat.

However, the frontier model (each company's most advanced AI) they were using to investigate the attack reportedly worked quite well at first, then started refusing to help. In his words, it was "a bit painful because we were in the middle of an investigation." From the perspective of an AI's safeguards (the mechanisms that refuse requests that could be misused), there is no way to tell whether someone closely analyzing attack logs is the attacker or the victim. A system built to stop bad actors ended up stopping someone trying to defend their own house.

Dax later reportedly said things improved after he was admitted to the Blue tier of Daybreak, OpenAI's program that gives legitimate defenders access to frontier models. Put another way, the investigation didn't go as planned until then. When a small team suddenly comes under attack, can it really get into a program like that right away? Attackers freely use AI with the safeguards stripped out, while defenders alone have to wait on paperwork. I suspect this gap will become a bigger problem 🛠️

So what should we do? But don't overreact

The redreamality.com analysis points out that coding agents hold keys for more than 75 providers and run a shell (a direct command interface to your computer) with the user's permissions, which makes them an attractive target for key theft. A place where many keys are gathered together is, for a thief, like a vault where one break-in yields a huge haul. That was the main theme of the article.

After going through the public sources, here's what I think is worth doing.

• If you used OpenCode Console, regenerate your OpenAI, Anthropic and Google keys and revoke the old ones, even if you didn't get an email
• Check your usage history and billing for the past few days in each provider's dashboard. If you see usage you don't recognize, contact the provider's support right away
• Issue separate keys for each tool. If one leaks, it's easier to trace where it leaked from, and you only have to revoke one
• If you can set spending limits or overuse alerts, set them. You could even argue that for one person, a $20 cap kept the damage at $20

On the other hand, there were also sensible voices warning against overreacting. Only 1.4% of Console users were affected, and users of the locally run CLI were not. Rather than deciding "OpenCode is dangerous, let's drop it entirely," it's more useful to remember that storing your keys on a company's servers carries this kind of risk. A convenient place to keep things is also a place that gets targeted all at once.

To sum up one more time: what hurt in this breach wasn't just the leak itself. It was that the bills arrived while explanations didn't, and that even the defenders couldn't rely on AI. I'll keep following how far OpenCode goes in publishing a root-cause analysis and a compensation policy 👀