One Legacy System, Three Provider Accounts: OpenCode’s Distillation-Attack Breach and the Key-Wallet Problem

2026-10-18 Agent & Supply Chain Security by al-ice.ai Editorial

On 17 October 2026, OpenCode — the open-source terminal coding agent with over 200,000 GitHub stars — emailed a subset of users of OpenCode Console, its hosted model gateway, with the subject “Action Required: Potential provider key breach.” The email said the team had “identified unauthorized access to a legacy system that we were in the process of decommissioning,” and that “third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed.” It asked recipients to revoke and replace those keys through the relevant provider’s dashboard, update any applications using them, and review recent usage for unexpected activity. Hours later, OpenCode posted on X that the breach was “related to a large scale distillation attack” and affected 1.4% of Console users.

That is nearly the entire primary record, and it is worth stating its boundaries before anything else. OpenCode has not said how the attacker got in, how long access lasted, how the keys were stored, or whether any were misused. “The incident is ongoing so we cannot share more details at this point,” the X post says. No CVE identifier has been attached to this incident in any reporting or advisory we reviewed, and there is no patch to evaluate because nothing has been described as a vulnerability — only an intrusion into a system that was already being retired. Everything below that is not in those two statements is labelled as reconstruction or analysis, with its source named.

What the day looked like, in order

The most careful reconstruction we found is CellCog’s minute-by-minute account, and its timestamps (all UTC, 17 October) are consistent with every other report we read:

14:14 — the notice surfaces on Reddit. The customer email is posted to r/opencode, hours before any public statement.
14:35 — spend alerts fire. A developer reports OpenAI, Anthropic and Google spend alerts going off together; of the three providers, only Google suspends the project for suspicious activity on its own.
15:18 — keys running up charges. Security researcher Matt Johansen reports customers’ keys accumulating charges they did not make. Separately, one user reported roughly $400 in unauthorised Anthropic charges.
17:56 — first statement. The OpenCode account posts on X; the post is edited at 18:08 to add the scale figure: 1.4% of Console users, described as a subset of “users who had external providers linked.” The company says it emailed every affected user that morning and that “if you did not get an email you were not impacted.” It is “working with Anthropic, OpenAI, and Google to remediate.”
18:41 — the founder is hit too. Dax Raad, who runs OpenCode, posts that his personal accounts are being attacked as well, adding: “whole new world with ai powered hacking”.

Two silences in that timeline deserve attention. First, CellCog notes that OpenCode’s status page showed no security incident at 19:00 UTC — only slow responses and a request-log outage earlier in the day. A status page that cannot say “we are investigating unauthorised access” while the company is emailing users about exactly that is a communications gap, not a technical one, but it is the gap users actually check. Second, 1.4% has no denominator. OpenCode publishes figures for the agent, not for Console, which is an optional paid layer on top of it — so the percentage cannot be converted into a number of people or a number of keys. Treat it as a statement of scope discipline (“a subset of users who had external providers linked”) rather than a measurement you can act on. If you linked a provider key to a Console workspace, the only question that matters is whether you got the email.

Why a distiller wants your key, specifically

“Distillation” usually means harvesting a strong model’s outputs to train a cheaper one. That takes an enormous number of paid API calls, and the labs treat unauthorised distillation as theft — a subject we have covered at length, including Anthropic’s accusation that seven labs ran roughly 190 million exchanges through Claude. CellCog’s account recalls Anthropic’s February 2026 report of industrial-scale distillation through tens of thousands of fraudulent accounts, and its October statement that new safeguards had cut harvested volume by 90 to 99%, with distillers resorting to false identities and stolen payment details.

Our read — which OpenCode has not confirmed — is that a real customer’s API key is the account a distiller cannot fake. It is verified, it already pays, and it has a normal usage history, which is exactly the profile anti-fraud and anti-distillation screening is tuned to wave through. Every improvement the labs make in detecting synthetic distillation accounts raises the relative value of a genuine one, and genuine ones are concentrated wherever developers were asked to paste them for convenience. That is the economic mechanism that turns a gateway breach into a distillation campaign, and it does not require the attacker to have planned it that way: once provider keys are in hand, burning them on model outputs is the highest-margin use available.

The key-wallet problem

Step back from OpenCode and the shape is familiar, because this feed keeps tripping over it. Console workspaces let owners and admins connect their own model providers, which is where these keys lived — OpenAI, Anthropic, Google, and whatever else a team linked. A developer who connects three providers to one hosted workspace has made that workspace’s weakest system the gate to all three accounts. Here the weakest system was, by the company’s own description, a legacy console it was in the process of retiring: the system closest to being forgotten held the credentials with the widest blast radius.

This is the third time in a week this site has documented AI infrastructure concentrating spendable secrets behind a boundary that did not hold. VulnCheck’s 122-CVE batch included twenty records across sixteen self-hosted AI products whose defect was, at bottom, that the AI feature holds provider keys and chat transcripts with no authorisation check in front of them. Arcane’s three CVEs turned on stored credentials being repointed at attacker infrastructure. The failure modes differ — missing check, repointed destination, breached legacy store — but the asset is the same string in all three, and the lesson generalises: bring-your-own-key tools are key wallets, and they should be defended like key wallets, with per-key scope, spend limits, and an inventory of where each key lives. Most are defended like settings pages.

One caution against over-reading: Safeguard’s write-up usefully lists OpenCode’s prior local-agent bugs — CVE-2026-22812 (CVSS 8.8, an unauthenticated local HTTP server) and CVE-2026-22813 (a markdown renderer placing raw LLM HTML into the page) — and states plainly that neither has been linked to this breach. We repeat that boundary. This incident, on current evidence, is not a product vulnerability at all; it is an operational one, in a system whose retirement was apparently slower than its exposure. That distinction matters for remediation: there is no version to upgrade to.

What to do

If you received the email, rotate everything that was ever saved in a Console workspace — including keys added by other admins — and then check whether the rotation was in time:

Create the replacement before revoking the old key. Google’s own guidance for a compromised Gemini key is to create the new key, deploy it, then disable the old one; the same order avoids an outage with every provider. After revoking, confirm the old key is dead (an authentication error on a direct API call), because a 200 means it is still live.
Pull provider-side usage from 16 October onward, and further back if you can. OpenCode has not said when access began, so the overnight window in the X post is a lower bound, not the exposure period. Look for spend spikes by day and by model, not just totals.
Rotate once, update everywhere. CI secrets, .env files, local agent configs and teammates’ machines routinely hold copies of the same key. Every copy you miss is a key you did not rotate.
Re-issue narrowly. One key per tool, scoped to a project rather than a broad legacy user key, with the lowest spend limit the workload survives and a billing alert below it. If you keep using Console with your own providers, give it a dedicated capped key — never the key your production application uses.
If you did not get the email, do the cheap parts anyway. OpenCode says un-notified users were not impacted. But an incident discovered through customer spend alerts rather than internal monitoring is evidence about detection maturity, and spend caps plus a key inventory are worth having before the next email — from any vendor.

The structural question this leaves open is the one the timeline answers worst: customers noticed before the company spoke. Spend alerts at 14:35, independent researcher reports at 15:18, first statement at 17:56 — the detection path ran through victims’ billing dashboards. For a platform whose whole function is metering model usage, provider-side anomaly detection on linked keys — impossible spend velocity, new geographies, distillation-shaped traffic — is not an exotic control. It is the home-field advantage, and it went unused.

Our verification was read-only. The email subject line, the “legacy system that we were in the process of decommissioning” attribution, the “may have been exposed” scope, and the revoke-and-review instructions are quoted from OpenCode’s customer email as reproduced verbatim in the Safeguard, Cyera and CellCog write-ups, which agree on the wording. The X-post wording (“large scale distillation attack,” 1.4% of Console users, “users who had external providers linked,” “working with Anthropic, OpenAI, and Google,” “incident is ongoing”), the 17:56 post / 18:08 edit times, the UTC timeline of the day’s events, the founder’s “whole new world with ai powered hacking” remark, the status-page silence, and the absence of a published Console user count are drawn from CellCog’s reconstruction and cross-checked against the Safeguard and Cyera accounts. The $400 unauthorised-charge figure is a single user’s report via ThreatCluster, not a confirmed total. Repository metadata (open-source coding agent, 200,000+ stars, under active development with pushes through 18 October 2026) was read first-hand from the GitHub API. The distillation-economics section is our analysis, labelled as such, built on our own prior distillation coverage linked above. No CVE has been published for this incident, so there is no NVD record to cite and no KEV entry to check; nothing was installed, no workspace was created, no key was tested, no provider endpoint was queried, and no third-party request was sent beyond reading the cited public pages. Brave Search was used for discovery; all factual claims above come from direct fetches of the pages listed below.

Sources: