OpenCode Console Breach via Distillation Attack

OpenCode, the coding-agent platform built by Anomaly Innovations, disclosed on October 17, 2026 that it had identified unauthorized access to a legacy Console system that was already in the process of being decommissioned ^[1]. The intrusion exposed third-party provider keys - OpenAI, Anthropic, and Google credentials - that users had saved inside their Console workspaces to connect external models ^[3]. OpenCode said the breach affected roughly 1.4% of Console users who had linked outside providers, and that it had emailed every affected account; anyone who didn't receive that email, the company said, was not impacted ^[2].

What makes the incident unusual is what the attackers were actually after. According to reporting on the breach, "the stolen asset was not stored user information. It was the ability to make large volumes of queries" against frontier models ^[4]. In other words, this wasn't a conventional data-theft breach where the prize is personal records - it was a credential-theft breach where the prize is compute access, billed to someone else's account. OpenCode's own statement, notably, never explained how the attackers got into the legacy system, how long they had access, or how many keys were actually taken ^[1]- leaving the scope and duration of the exposure an open question even as remediation moves forward.

OpenCode has attributed the breach to what it calls a "large scale distillation attack" ^[1]. Distillation, in AI terms, is the practice of training a cheaper model to mimic a more expensive one by feeding it huge volumes of the expensive model's outputs. Stolen OpenAI, Anthropic, and Google keys give an attacker exactly that: a way to run massive numbers of queries against frontier models under someone else's billing and rate limits, harvesting high-quality responses without paying for compute or doing original research ^[4]. As one security research team put it, "anyone holding a stolen provider key can run workloads on your account and run up your bill. Depending on how the key is scoped, they can also reach the files, prompts and fine-tuned models tied to it" ^[5].

This isn't the first time something like this has surfaced. Anthropic had already documented similar distillation methods used by other actors back in February 2026 ^[4], and a separate campaign reported in September 2026 reportedly saw China-based AI labs pull roughly 190 million exchanges out of Claude to help train competing models ^[5]. Analysts covering the OpenCode breach note that stolen keys belonging to established, high-spend customers are worth more on this market than freshly created accounts, because new accounts increasingly run into anti-abuse restrictions that older, trusted accounts don't ^[6]. A compromised OpenCode Console key, in that sense, wasn't just a backdoor - it was a pre-vetted, high-limit pass into GPT, Claude, and Gemini.

Security researchers have framed the OpenCode breach as a symptom of something structural, not incidental: "coding agents are credential magnets by design. They talk to several model vendors, drive your toolchain, spawn MCP child processes and load skills and plugins that update themselves" ^[6]. A tool like OpenCode routes requests to OpenAI, Anthropic, and Google through a single hosted gateway - convenient for developers juggling multiple models, but it also means one compromised system can expose several vendors' credentials in a single hit, rather than forcing an attacker to breach each provider separately ^[7].

Notably, this risk was specific to OpenCode's hosted Console product, not its local CLI. The CLI stores provider keys locally in the user's own configuration files, so those credentials never reach OpenCode's servers at all ^[7]- which is why the company could say with confidence that CLI-only users were never exposed. Analysts have also placed this breach alongside a string of other 2025-2026 incidents that targeted credentials sitting near developer tooling, including the Nx postinstall compromise, Amazon Q's CodeBuild token leak, the Shai-Hulud npm worm, and slopsquatting package hallucinations ^[6]- a pattern suggesting that as AI coding tools accumulate more vendor integrations, they become a preferred target precisely because of how much they're trusted with.

The financial fallout was immediate and uneven. Reported unauthorized charges on exposed keys ranged from around $400 on Anthropic accounts to more than $1,700 overnight on combined OpenAI/Anthropic usage, with one user reporting roughly €200 in unauthorized Google charges that triggered an account suspension for abuse ^[2][8]. Anthropic moved quickly on its side: engineer Lydia Hallie said the company had "been working with OpenCode on yesterday's breach and have revoked Claude API keys we believe were affected," while still urging cautious users to rotate keys on their own ^[2].

But alongside the money fight, a second argument broke out over OpenCode's own framing. On X, AI researcher Nathan Lambert publicly questioned why a credential-theft incident was being described using the "distillation" label normally reserved for a model-training technique, calling it odd that volume this high was being looped under the same term as model-transfer concerns. That skepticism echoed loudly on Reddit, where much of the reaction treated "distillation attack" as framing that deflected from what many users saw as a more basic security failure - a deprecated system that still held live credentials. OpenCode's statement that its investigation had "to date" found no evidence other data had leaked ^[1]did little to settle that argument, since it left open exactly how much the company still didn't know about its own breach.