1. Home
2. News
3. Anthropic

OpenCode says a distillation attack exposed the AI provider keys of 1.4% of its Console users

The stolen keys were users' own Anthropic, OpenAI and Google keys, and a stolen key bills its owner.

By Think Facility · October 19, 2026 · Anthropic AI security Save

On October 17, 2026, the team behind the AI coding tool OpenCode said a breach the night before had hit 1.4% of the people who use OpenCode Console, a separate product from the coding tool itself. What was at risk were API keys those users had saved there for other companies' models.

OpenCode tied the breach to a "large scale distillation attack" and said it was working with Anthropic, OpenAI and Google to clean it up. It emailed the affected users that morning. If you didn't get an email, it says, you weren't hit.

What was taken

The keys were the users' own, issued by the model companies and pasted into Console so OpenCode could call those models for them. Whoever holds a key can run up a bill on it.

Dax Raad, posting for the OpenCode side ("those keys never come to us"), drew a line that matters for most OpenCode users. The breach was in Console. The open-source coding tool people run on their own machines doesn't send keys to the company, so keys set up there weren't exposed.

On the Claude side, Lydia Hallie posted the same day that they'd been working with OpenCode on the breach and had revoked the Claude API keys they believed were affected. Anyone who saved a key in OpenCode and wants to be careful should make a new one, the post said.

Why a distiller wants your key

Distillation means sending a strong model millions of prompts and training a smaller model on what comes back. On October 12, 2026, five days before this breach, Anthropic described how it fights it, and the account is the best guide to why stolen keys are useful to a distiller.

Anthropic wrote that distillers run proxy networks controlling hundreds of thousands of fraudulent accounts, some built with false identities and stolen payment details. Its defenses now ban accounts it catches distilling, and it says it has banned tens of thousands, often within two hours. A real customer's key looks like a real customer, with a real card behind it. That's my reading of why a pile of saved keys is worth breaking into. OpenCode hasn't said who the attackers were or how many keys they used.

Anthropic's post also asks platforms to do their part by detecting abuse quickly and offboarding fraudulent accounts. OpenCode is that kind of platform, and its post says it's working with all three labs. We wrote about the October 12 post when it came out.

What it means if you saved a key somewhere

This is the part that reaches past AI companies. Handing an API key to a coding tool, an IDE or an agent platform is close to handing over a card number. Anthropic's own help page makes that comparison: if someone gets your key and uses it, the charges land on you.

The same page gives the steps. Delete a key you think was exposed and make a new one. Set usage and spend limits, or cap auto-reload, so a stolen key can only burn so much. Keep separate keys for separate jobs, so you can kill one without breaking everything.

One wrinkle is new this autumn. Anthropic says that since September 24 it charges for requests its safeguards block before Claude answers, in areas such as distillation where the false-positive rate is under 0.1%. So a stolen key that a distiller hammers can cost its owner money even when Anthropic stops the attack. OpenCode's post doesn't mention refunds, and Hallie's post covers revoking keys only.

Raad's line is the practical test for anyone using OpenCode today. If your keys live only on your own machine, this breach didn't reach them. If you pasted them into Console, OpenCode says you'd have had an email on October 17.