OpenCode, the open-source AI coding agent that lets developers plug their own API keys from OpenAI, Anthropic, Google and dozens of other providers into a single terminal-based tool, has disclosed a security breach that it says exposed a subset of its users’ provider credentials.

In a statement posted to its community and in emails sent to affected customers on the morning of October 18, OpenCode said it had “identified unauthorized access to a legacy system” that was in the process of being decommissioned, and that “third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed.” The company is describing the incident as a “large scale distillation attack” that impacted roughly 1.4% of OpenCode Console users, and says it has notified everyone affected individually by email. If a user did not receive that email, OpenCode says, they were not among those impacted.

OpenCode co-founder Dax Raad said that his personal accounts were also being attacked. “Whole new world with AI-powered hacking,” he said.

The company has not released further technical details, saying only that “the incident is ongoing so we cannot share more details at this point,” and that it is working with Anthropic, OpenAI and Google to remediate the issue. Affected users have been asked to revoke and replace their keys through the relevant provider’s dashboard, update any applications using them, and review recent usage for anything unexpected.

What OpenCode actually does

OpenCode is a fully open-source AI coding agent built by the team behind the serverless framework SST, now operating as Anomaly Innovations. Unlike closed, single-vendor tools, OpenCode is designed to be provider-agnostic: it runs as a terminal UI, desktop app or IDE extension, and lets a developer wire it up to more than 75 different model providers, from Anthropic’s Claude and OpenAI’s GPT models to Google’s Gemini and locally hosted open-weight models. Since its launch in June 2025, it has grown into one of the most widely used open-source coding agents, reportedly crossing 150,000 GitHub stars.

Because OpenCode itself is free, most users pay only for whatever model they choose to connect, which means the tool depends on people storing their own provider API keys inside it. OpenCode Console is the hosted dashboard where users manage accounts, subscriptions and, crucially, these linked provider credentials, making it a fairly attractive single point of failure if compromised.

What a “distillation attack” means here

OpenCode’s choice of the term “distillation attack” is notable. In AI circles, distillation ordinarily refers to the legitimate practice of training a smaller model on a larger one’s outputs to approximate its capabilities more cheaply. But the term has increasingly been used, including by OpenAI and Anthropic themselves, to describe unauthorized attempts to systematically query a frontier model at scale through someone else’s paid access in order to harvest its outputs for training a rival model. Anthropic has previously told investors that such extraction by competing labs has had a measurable effect on its revenue, a dynamic covered in more detail here.

If OpenCode’s description holds, the risk for affected users is twofold: attackers could rack up usage charges by hammering their linked OpenAI, Anthropic or Google accounts, and those same accounts could have been used as a conduit to pull large volumes of model responses for training purposes, potentially in violation of each provider’s terms of service. That would explain why OpenCode says it is coordinating with all three labs rather than handling this purely as an internal incident.

A tool with a prior security track record

This isn’t the first time OpenCode’s security has come under scrutiny. Researchers disclosed a critical remote-code-execution flaw in the tool earlier in 2026 (tracked as CVE-2026-22812), stemming from an unauthenticated local HTTP server that older versions launched automatically, one that could, in the worst case, let a malicious website execute code on a developer’s machine simply by being visited. OpenCode patched that issue in version 1.1.10. The breach disclosed this week appears to be unrelated, originating instead from an internal “legacy system” OpenCode says it was already retiring, but it adds to a pattern of security incidents around AI coding agents generally.

What this means for users

For the roughly 1.4% of OpenCode Console users caught up in this, the immediate advice from the company is straightforward: rotate every provider key that was linked to OpenCode, check usage logs on the OpenAI, Anthropic and Google dashboards for anything that looks out of place, and update any downstream tools or scripts that relied on the old keys. More broadly, the incident is a reminder of a structural risk in the growing category of “bring your own key” AI tools: convenience and provider flexibility come at the cost of concentrating multiple high-value credentials inside a single third-party application, one that only needs to be breached once for several AI accounts to be exposed at the same time.

OpenCode has said it will share further updates as its investigation continues.