OpenCode's maker, Anomaly Innovations, has told roughly 1.4% of OpenCode Console users that third-party provider keys saved in their workspace "may have been exposed" after "unauthorized access to a legacy system." If you linked an OpenAI, Anthropic or Google key in the Console and received the email, rotate those keys at each provider now. This post separates what the company has stated from what is still unconfirmed.
TL;DR
| Question | Answer |
|---|---|
| Am I affected? | Per OpenCode, only Console users with external providers linked, and those users were emailed. No email means not impacted, by the company's account. |
| Is there a fix? | Not for the exposure itself. Rotate the keys; the company says its response is ongoing. |
| Were keys actually misused? | Unconfirmed by OpenCode. Some users report unexpected charges on provider bills. |
| Does data leave my machine? | Not from local use of the agent as such; the exposed keys were stored in the vendor's Console workspace. |
What is claimed and what is verified
OpenCode posted on X on October 17 that the incident was "a large scale distillation attack that impacted 1.4% of OpenCode Console users," per Cyera's write-up, which reproduces the statement. We could not retrieve the post ourselves, so quotes here come from secondary coverage of it.
Stated by the company (via coverage):
- The notice said it identified unauthorized access to a legacy system, reportedly one being retired.
- Third-party provider keys "saved in your workspace may have been exposed," per Startup Fortune.
- It is working with Anthropic, OpenAI and Google, has found no evidence of other data leaking "to date," and cannot confirm whether exposed keys were used maliciously.
Not confirmed:
- How attackers got in, when it was first detected, and what 1.4% equals in accounts.
- How the keys were stored, for example whether they were encrypted.
- Whether keys in local config files were touched.
- Reports of bills "climbing into the hundreds of dollars" and of suspended provider accounts are user claims on social media and in press; the outlet could not verify them.
- The "distillation" label. Harvesting model outputs does not explain how keys were obtained, so the confirmed fact is the legacy-system access, not the attack category. explainx.ai has the news timeline.
What this means if you run AI coding agents
- Check your inbox first. An email from OpenCode is the company's own signal of impact. Do not click links in it; go to the dashboards directly.
- Rotate at the provider. Revoke and reissue in the OpenAI, Anthropic and Google consoles, update the tools and CI jobs that use the key, and confirm the old one fails.
- Review usage from October 16 onward for spikes, unfamiliar models and odd hours.
- Set hard spend limits and alerts on every provider account, and use one key per project so a leak has a small blast radius.
- Remove providers from the Console you no longer use, and reset your OpenCode password.
- Consider rotating anyway. If you never received an email but pasted keys into the Console, rotating costs little, even though the company says you were not affected.
OpenCode has had other security trouble this year: Datadog Security Labs documented a remote code execution flaw in its upgrade endpoint, fixed in 1.18.22. That is a separate issue, but it is another reason to keep the tool updated.
What Beam can and cannot do here
Beam did not see this attack: the keys were taken from a vendor-side system, not from your machine. What Beam can do is shrink what is lying around locally. It flags credential exposure in agent tool calls on Claude Code and Codex, and redacts known credential formats before storage, all on-device. It does not rotate keys, cannot see a vendor's servers, and its detection is heuristic. See how Beam works and the local-first design.
For related reading, see the criminal AI API key reseller supply chain, agents harvesting credentials from loot folders, fake Claude Code installers, our incident timeline and the vibe coding security checklist.
Frequently asked questions
Was I affected by the OpenCode Console breach?
OpenCode says it emailed every affected account and that users who received no email were not impacted. Only Console users who had linked external providers such as OpenAI, Anthropic or Google were affected, about 1.4% of Console users by the company's count.
Are keys stored only in my local OpenCode config exposed?
Unknown. The company's notice refers to provider keys saved in a Console workspace. It has not said whether keys in local config files were involved, so treat any key you ever pasted into the Console as suspect.
How should I rotate the keys?
Revoke and reissue each key in the provider's own dashboard by going there directly, not through an emailed link. Update your tools and CI, confirm the old key no longer works, and review usage from October 16 or 17 onward.
Was it really a distillation attack?
That is OpenCode's label. Distillation means harvesting model outputs, which does not by itself explain how keys were obtained, and the company has not published technical detail. Judge by the confirmed fact: unauthorized access to a legacy system.
Does this affect Claude Code or Codex users?
Only if you also used OpenCode Console and saved a provider key there. The wider lesson is that a key stored in any third-party service is only as safe as that service.
Details reflect public statements as of October 17, 2026 and may change as OpenCode's investigation continues.