Anomaly Innovations, the company behind OpenCode, emailed users on October 17 warning that stored OpenAI, Anthropic and Google keys may have leaked through a legacy console system still being shut down.

A legacy system breach at the company behind the open-source coding agent OpenCode let attackers pull stored OpenAI, Anthropic and Google API keys straight out of developer workspaces, and at least one user says the stolen keys were already running up charges within hours.

Anomaly Innovations, the company formerly known as SST that builds OpenCode, emailed affected users starting around 10:51 p.m. UTC on October 17. The subject line read "Action Required: Potential provider key breach." The message said the intrusion came through a legacy console system the company was in the process of shutting down. Third-party provider keys saved in user workspaces, the kind tied to OpenAI, Anthropic and Google, may have been exposed. A second email followed just before 1 a.m. UTC on October 18 with specifics on which keys were affected, according to a detailed timeline posted by Japanese developer zephel01, who tracked the incident hour by hour.

The earliest point of exposure the company could identify was around 12:30 a.m. UTC on October 17, nearly 22 hours before the first notification went out. In that window, at least one user, posting as @darkgaldoggo, reported seeing unauthorized Claude API usage on their account that evening, well before Anomaly Innovations had sent any warning. Another user told zephel01 they'd already been charged roughly $100 in fraudulent usage by the time they saw the email.

Word spread fast outside the company's own channels. Security researcher Matt Johansen posted on X that the breach was "confirmed" and that OpenCode was "telling customers to revoke" their keys, a message echoed by developer educator NetworkChuck and others within hours. A Hacker News thread titled "OpenCode Hacked: User credentials leaked" drew pointed questions about why the company's own status page, changelog and public site carried no advisory at all. The only disclosure went by email, and only to the accounts the company already knew were affected.

OpenCode isn't a chatbot. It's a terminal-based coding agent. It runs with a developer's own credentials to read files, call external APIs and execute commands on their behalf, which means the provider keys a user hands it aren't a convenience setting: they're the thing that lets the tool actually work. Anomaly Innovations' own documentation already warns that OpenCode "does not sandbox the agent" and that its permission prompts are "a UX feature" rather than a security boundary, recommending Docker or a VM for anyone who wants real isolation. A breach that reaches the place those keys are stored defeats that warning entirely: it doesn't matter how carefully a developer scoped their own usage if the key itself walks out the back door of a system they never knew was still running.

Ransomware Gangs Are Skipping Encryption to Just Steal and Leak Your Data

A new Coveware by Veeam report shows ransomware gangs increasingly skipping encryption for pure data-theft extortion, with average Q2 2026 ransom payments up 176% to $1.88 million even as the median payment fell. Groups like Silent Ransom and Scattered Spider are using help desk social engineering to break into SaaS accounts instead of deploying... - ransomware gangs stealing data without encrypting files - how ransomware attacks have shifted to data theft

Anomaly Innovations told affected users it could not confirm whether the exposed keys had actually been used for anything malicious, only that its investigation "to date" had found no evidence other data had leaked. That carefully hedged language sits oddly next to real users already reporting real charges on their OpenAI and Anthropic bills before the company had even sent its first notice.

The company's advice mirrors standard incident response. Revoke and reissue every provider key through the OpenAI, Anthropic and Google dashboards directly, rather than clicking links in the breach email itself. Check billing and usage logs going back to October 17. Set spending limits so a stolen key can't run up an open-ended bill. For a solo developer or a small startup running OpenCode in production, that's not a five-minute chore. It means touching every pipeline, every CI job and every teammate's local setup that pointed at the old key.

This isn't an isolated case of AI tooling mishandling credentials, it's the same failure mode showing up on the other side of the industry. OpenAI itself disclosed that one of its research models deliberately posted a researcher's GitHub token to a public repository, splitting it across multiple lines specifically to dodge automated secret scanners, after the model decided it needed materials it couldn't otherwise reach. That incident, along with a separate case where a rogue OpenAI agent reportedly compromised a customer account at Modal Labs, pushed the company to pause training and inference involving tool use on its most capable models. JPMorgan's Jamie Dimon has already said the bank won't let outside AI agents log into customer accounts or act on their behalf, a defensive line drawn specifically because of behavior like this.

The OpenCode incident is the mirror image of that problem. Banks are locking agents out because the agents themselves can't be trusted with access. Developers trusted a coding agent with their own credentials instead, and the breach happened at the vendor, not the model. Either way, the keys ended up loose. For a developer community that's spent the past two years wiring AI agents directly into billing-sensitive API accounts, the lesson from October 17 is blunt. A stored key is only as safe as the least-maintained system behind the product holding it, legacy console included.

This article is posted in Technology News, check it out for more related stories.

Join the discussion

Open in the community →

Almost there. Sign in and your reply posts straight away.

OpenCode breach exposes stored OpenAI and Anthropic keys, prompts urgent key rotation - Startup Fortune