Artificial Intelligence
OpenCode breach exposes API keys
Anomaly Innovations said a breach linked to a distillation attack affected about 1.4% of OpenCode Console users and exposed stored provider keys, prompting account notifications and urgent key rotations.
- Anomaly Innovations said the incident affected roughly 1.4% of OpenCode Console users and exposed stored OpenAI, Anthropic and Google API keys in some workspaces.
- The company said it emailed affected accounts on the same morning and was working with OpenAI, Anthropic and Google on remediation.
- The article said the company had identified unauthorised access to a legacy system and warned that third-party provider keys saved in workspaces may have been exposed.
- Anomaly Innovations said it had found no evidence that other data had leaked, but it could not confirm whether the exposed keys had been used maliciously.
Anomaly Innovations said a breach exposed stored provider keys in some OpenCode workspaces and affected about 1.4% of OpenCode Console users. The company said it notified affected accounts by email on the same morning and was working with OpenAI, Anthropic and Google.
The article said the company linked the incident to what it called a distillation attack, although it did not explain the access path in detail. It also said the company had found no evidence so far that other data had been taken.
The piece said some users reported charges on their OpenAI and Anthropic accounts, but those reports were not verified. Anomaly Innovations said it could not confirm whether the exposed keys had been used for anything malicious.
Later coverage quoted the company as saying unauthorised access had been found in a legacy system and that provider keys saved in workspaces might have been exposed. It advised users to rotate keys and review billing and usage logs.
Named in this story
People
- Dax Raad
- was reported as saying his own accounts were also under attack
Companies
- Anomaly Innovations
- confirmed the breach and said it affected a small share of OpenCode Console users
- OpenAI
- one of the API providers whose keys were said to have been exposed
- Anthropic
- one of the API providers whose keys were said to have been exposed
- one of the API providers whose keys were said to have been exposed
Products and systems
- OpenCode
- the open-source coding agent built by Anomaly Innovations
- OpenCode Console
- the workspace console where the affected accounts stored provider keys
How the source tells it
The piece mixed incident reporting with alarmist and speculative framing, especially around the consequences of the exposed keys and the disputed label for the incident.
- alarm vivid metaphor and worst-case consequences were used to make the credential exposure feel more severe
- urgency same-day notifications and immediate rotation advice were used to press the reader towards rapid action
- speculation presented as fact the incident was repeatedly tied to a distillation label before the sequence of events was confirmed