Anomaly Innovations, the company behind the terminal coding agent OpenCode, confirmed a breach on Saturday. It says 1.4 percent of OpenCode Console users are affected, specifically those who had stored keys for outside providers there: Anthropic, OpenAI and Google.
The email to affected users says someone gained unauthorized access to a legacy system that is being decommissioned, and that provider keys saved in their workspace may have been exposed. The company ties the incident to a large-scale distillation attack, meaning the harvesting of a model’s responses to train another model. Anyone who did not get an email was not affected, according to the company. The incident is still open, and Anomaly Innovations says it is working with Anthropic, OpenAI and Google on it.
The bills arrived before the warning
On a Reddit thread and on X, affected users report charges they never made. One puts the damage on his Anthropic account at $400. Another says Google usage charges reached roughly €200 and the project was suspended for excessive abuse. A third writes that usage alerts from both OpenAI and Anthropic reached him before OpenCode said anything. On top of that came expired OpenCode keys and sign-ins through Google or GitHub that failed with “Unable to start social login.”
The company says it cannot confirm whether the exposed keys were actually used, only that its investigation to date found no evidence that other data leaked. Co-founder Dax Raad was reported as saying his own personal accounts were being attacked too.
The agent runs on your credentials
OpenCode is not a chatbot. It is an agent in the terminal that works with the developer’s own credentials: it reads files, calls outside APIs, runs commands. The provider keys there are not a convenience setting, they are what makes the tool work at all. The company’s own documentation says the agent is not sandboxed and that its permission prompts are a usability feature rather than a security boundary, recommending Docker or a VM for real isolation. I wrote about the OpenCode desktop app here before.
Your machine was not the leak
What makes this one uncomfortable is where it happened. The key did not walk out through anyone’s laptop. It walked out of a system users did not know was still running. No amount of care in the terminal protects against that, and neither does a carefully scoped permission model.
What does help is assuming that every key you store somewhere will be exposed eventually: a separate key per tool, a spend limit in the Claude Console, and a look at your usage before the invoice shows up. If you used OpenCode with Anthropic keys, revoke and replace them now, update the applications that use them, and read through the last few days of usage.