OpenCode tells users to replace API keys after a breach

About 1.4 per cent of OpenCode Console users were hit, the company says. Only workspaces with an outside provider’s key saved in them were exposed. Anomaly ties the breach to a large-scale distillation attack. In distillation, a lab copies a model’s skills by feeding a second model huge numbers of its replies, and every reply is a paid query. Anomaly has not said how the stolen keys and the distillation connect, and some researchers, Nathan Lambert among them, have questioned the label.

The notice asks users to swap their keys and look for usage they do not recognise, Runtime Wire reports. Anthropic, OpenAI and Google are helping with the response, Anomaly says. Some users report charges for queries they never made, Startup Fortune adds, and the company says its inquiry has found no other data taken so far.

If your team keeps model keys inside a third-party tool, a monthly cap on every key puts a ceiling on what a leaked one can spend.