OpenCode got breached for the keys: a distillation attack hit 1.4% of Console users and ran up their Anthropic, OpenAI and Google bills overnight
Four days after OpenCode 2.0 took 848 points on HN, OpenCode's account posted at 17:56 UTC on October 17 that it had a security breach last night related to a large scale distillation attack that impacted 1.4 percent of OpenCode Console users. A second version twelve minutes later added that everyone affected had been emailed and that it was a subset of users who had external providers linked. The incident is ongoing, so no more details, but the company is working with Anthropic, OpenAI and Google to remediate. The reposted statement passed 619,000 impressions and 5,800 likes. The HN thread hit 542 points in four hours.
The email, quoted by the HN submitter, says more than the tweet. OpenCode identified unauthorized access to a legacy system it was in the process of decommissioning, and third-party provider keys saved in your workspace, OpenAI and Anthropic named as examples, may have been exposed. Users are told to revoke and replace those keys in each provider's dashboard. Console is the hosted side of OpenCode, the Zen subscription where you can store keys for any model provider, which is why the local-only crowd on HN kept saying this does not touch them. Reports in the thread and on X put the damage at hundreds of dollars per victim; one user said two keys used only inside OpenCode ran up over $400 starting around 2am Eastern, and another reply mentioned $1,700. Those are user claims, not confirmed by OpenCode.
The word distillation is the interesting part, and it is OpenCode's word, not a reporter's. The attackers did not want passwords or card numbers. They wanted authenticated access to frontier models, and a key aggregator is the cheapest place to get it, because one legacy system holds side doors to three labs at once. Anthropic documented distillation attacks in February and the labs have since tightened direct access, which pushes the pressure onto every intermediary that holds keys. One X reply got the structure right: the OpenCode breach is not an OpenCode story, it is the story of every coding tool asking for provider keys that have no spend limit, work from anywhere, and sit in a dashboard you never open. The HN thread had its own subplot: the submitter complained the post was being flagged, and a commenter linked a 68-day-old warning about OpenCode's data handling that had been dismissed at the time.
What is still unknown: how the attacker got into the legacy system, how long they had access, whether Google keys were actually used, how many accounts 1.4 percent is, and who eats the bills. Several people reported that Anthropic had already revoked the Claude keys it believed were affected, which if true means the key issuer ended up being the one able to switch it off. OpenAI and Google had said nothing by Saturday night. There is no advisory on anoma.ly or the GitHub repo yet.
The practical lesson is older than agents but agents made it urgent. One key per tool, a hard monthly cap on each, usage alerts to your phone, and delete the keys of tools you stopped using. Short-lived scoped credentials with workload identity would make a stolen token useless elsewhere, and that is exactly the product Keycard and others pitched in the replies within the hour. The OpenCode 2.0 article four days ago called the daemon plus Code Mode the direction of the category. The breach is the cost of being a category: the harness that holds the most keys is the harness worth breaking into.
Links: https://x.com/opencode/status/2111519637049319818 , https://x.com/opencode/status/2111516673953935833 , https://news.ycombinator.com/item?id=50133401 , https://cryptobriefing.com/opencode-distillation-attack-api-key-breach/ , https://github.com/anomalyco/opencode
← Back to all articles
The email, quoted by the HN submitter, says more than the tweet. OpenCode identified unauthorized access to a legacy system it was in the process of decommissioning, and third-party provider keys saved in your workspace, OpenAI and Anthropic named as examples, may have been exposed. Users are told to revoke and replace those keys in each provider's dashboard. Console is the hosted side of OpenCode, the Zen subscription where you can store keys for any model provider, which is why the local-only crowd on HN kept saying this does not touch them. Reports in the thread and on X put the damage at hundreds of dollars per victim; one user said two keys used only inside OpenCode ran up over $400 starting around 2am Eastern, and another reply mentioned $1,700. Those are user claims, not confirmed by OpenCode.
The word distillation is the interesting part, and it is OpenCode's word, not a reporter's. The attackers did not want passwords or card numbers. They wanted authenticated access to frontier models, and a key aggregator is the cheapest place to get it, because one legacy system holds side doors to three labs at once. Anthropic documented distillation attacks in February and the labs have since tightened direct access, which pushes the pressure onto every intermediary that holds keys. One X reply got the structure right: the OpenCode breach is not an OpenCode story, it is the story of every coding tool asking for provider keys that have no spend limit, work from anywhere, and sit in a dashboard you never open. The HN thread had its own subplot: the submitter complained the post was being flagged, and a commenter linked a 68-day-old warning about OpenCode's data handling that had been dismissed at the time.
What is still unknown: how the attacker got into the legacy system, how long they had access, whether Google keys were actually used, how many accounts 1.4 percent is, and who eats the bills. Several people reported that Anthropic had already revoked the Claude keys it believed were affected, which if true means the key issuer ended up being the one able to switch it off. OpenAI and Google had said nothing by Saturday night. There is no advisory on anoma.ly or the GitHub repo yet.
The practical lesson is older than agents but agents made it urgent. One key per tool, a hard monthly cap on each, usage alerts to your phone, and delete the keys of tools you stopped using. Short-lived scoped credentials with workload identity would make a stolen token useless elsewhere, and that is exactly the product Keycard and others pitched in the replies within the hour. The OpenCode 2.0 article four days ago called the daemon plus Code Mode the direction of the category. The breach is the cost of being a category: the harness that holds the most keys is the harness worth breaking into.
Links: https://x.com/opencode/status/2111519637049319818 , https://x.com/opencode/status/2111516673953935833 , https://news.ycombinator.com/item?id=50133401 , https://cryptobriefing.com/opencode-distillation-attack-api-key-breach/ , https://github.com/anomalyco/opencode
Comments