On October 17, 2026, OpenCode disclosed that a large-scale distillation attack had hit 1.4% of OpenCode Console users: the ones with external model providers linked to their account. OpenAI, Anthropic and Google keys stored in the service may now be in someone else's hands, and the company is asking users to revoke them.
What happened
OpenCode is best known for its open source coding agent for the terminal and desktop, with more than 215,000 stars on GitHub. The breach is not in that agent, though. It is in OpenCode Console, the company's web service where users can link their model provider accounts.
In its announcement on X, OpenCode said the intrusion happened the night before and was "related to a large scale distillation attack". It emailed every affected user that same morning and said that anyone who did not get an email was not impacted. Follow-up coverage, such as OfficeChai's, adds that the attackers got in through a legacy console system that was being decommissioned, and that the exposed keys belonged to OpenAI, Anthropic and Google. There is no postmortem yet: OpenCode calls the incident ongoing and has shared no further technical detail.
The naming has made things worse. In the Hacker News thread, which reached almost 700 points, a good share of the comments are about telling Console apart from the terminal agent. The announcement only covers Console users with linked providers; people running the agent with keys stored locally are not among those affected.
Why a distillation attack wants your keys
Distilling a model means training a smaller one on the outputs of a more capable one. Doing that at scale takes millions of calls to a frontier model, and providers rate-limit and monitor that kind of usage. A batch of stolen keys solves both problems: the volume gets spread across many accounts, and someone else pays the bill.
That changes how you measure the damage. The main risk is not someone reading your prompts but someone spending on your key until you revoke it or hit your billing limit. So the first move is to cut off access, not to investigate.
What to do if you used OpenCode Console
If you got the email, or you are not sure whether you linked providers in Console:
- Create a new key in each affected provider's console (OpenAI, Anthropic, Google) and update the applications that use it.
- Revoke the old one as soon as the new one works. A leaked key stays valid even after OpenCode retires its legacy system.
- Review recent usage on each account by day and by model. Distillation leaves a recognisable pattern: request spikes on the most capable models that do not match your traffic.
- Set spending limits per project or per key where your provider supports them, so the next leak has a ceiling.
- Unlink any providers you no longer need from Console.
If you only use the open source agent with environment variables or its local config file, the announcement does not include you. Still, if you ever pasted those same keys into Console, treat them as exposed: a key is the same key wherever it lives.
The lesson: one key per integration
The pattern is not new, but coding agents make it worse. Every tool that offers "bring your own key" turns into a store of provider credentials, and many teams reuse the same key in the IDE, in CI and in two or three intermediary services. When one of them is breached, you have to rotate everywhere at once.
The defence is boring and it works: a separate key per tool and per environment, named after where it lives, with its own spending cap and usage alerts. Then, when an email like OpenCode's arrives, rotating means revoking a single key rather than auditing half the company. And before pasting a key into a web service, the useful question is what that service will do with it on the day it gets decommissioned.