Hackers Drained Developer API Balances Overnight: OpenCode Breach Hits 1.4 Percent of Console Users in a Distillation Attack

OpenCode, the popular open-source terminal coding agent, disclosed on October 17 that a security breach had exposed third-party API keys belonging to roughly 1.4 percent of its Console users. In a post on X, the company — Anomaly Innovations, formerly known as SST — said the incident was related to "a large scale distillation attack" and that every affected account had been notified by email the following morning. Users who linked external providers to their accounts were the ones hit; everyone else was told they were untouched.

The entry point, according to the customer notice quoted by community members, was a legacy system that OpenCode had been preparing to decommission when unauthorized access occurred. Third-party provider keys saved in user workspaces — the company named OpenAI and Anthropic as examples — may have been exposed. Console is the hosted side of OpenCode, the subscription service where developers can store credentials for any model provider, which is exactly why a single compromised system held side doors to three labs at once.

The word "distillation" is doing heavy lifting here, and it is OpenCode's own term. The attackers apparently did not want passwords or card numbers; they wanted authenticated access to frontier models. Distillation means querying a powerful model at scale to harvest outputs that help train a cheaper one — and buying that training data through official APIs costs millions of dollars, which is why labs prohibit it in their terms. A key aggregator holding hundreds of real developer credentials is the cheapest place in the ecosystem to get it, and every token burned lands on the victim's invoice.

The financial fallout arrived before the disclosure did. In Hacker News threads and on X, users posted screenshots of API bills that spiked overnight starting around 2 a.m. Eastern — one reported more than $400 charged to two keys used only inside OpenCode, another mentioned $1,700. Those are user claims, not company-confirmed figures. Anthropic's Lydia Hallie said in community channels that all suspected leaked Claude keys had been force-revoked, while OpenAI and Google had not commented publicly as of Saturday night. OpenCode co-founder Dax Raad said his personal account was also hit.

The response playbook is the standard one, and OpenCode has been explicit about it: revoke and replace exposed keys in each provider's dashboard, update applications that depend on them, and review usage logs and bills since October 17. The company said it is working with Anthropic, OpenAI and Google on remediation, but the investigation remains ongoing and it has declined to share technical details — including how the attacker got into the legacy system, how long access lasted, and how many accounts 1.4 percent amounts to.

The structural lesson is older than agents but agents made it urgent. Bring-your-own-key tools concentrate several high-value credentials in one third-party application, so one breach exposes multiple AI accounts at once. The defenses are unglamorous: one key per tool, a hard monthly cap on each, usage alerts, and deleting the keys of tools you stopped using. Short-lived scoped credentials that die when stolen would make this attack class far less profitable — and until that becomes the default, the harness that holds the most keys will keep being the one worth breaking into.