OpenCode breach exposes stored OpenAI and Anthropic keys, prompts urgent key rotation

A large-scale distillation attack against the company behind the open-source coding agent OpenCode exposed stored OpenAI, Anthropic and Google API keys for a subset of developer workspaces, prompting an urgent round of key rotations across the developer community. Anomaly Innovations, the company formerly known as SST that builds OpenCode, confirmed the breach from its official account, saying the incident was "related to a large scale distillation attack" that impacted roughly 1.4% of OpenCode Console users. The company said it notified every affected account by email the same morning, and that only a subset of users who had external providers linked to their accounts were affected. Anomaly Innovations said it was working with Anthropic, OpenAI and Google to remediate the incident.

First reported by Startup Fortune. This page is a short excerpt; the full text is theirs.