What happened
On the night of Oct 16, 2026 an intruder reached a legacy system in Anomaly's OpenCode Console (its optional hosted workspace service) that was being decommissioned. The company emailed affected users on Oct 17 ('Action Required: Potential provider key breach') and stated that third-party provider keys saved in Console workspaces — OpenAI, Anthropic and Google — may have been exposed. OpenCode called it a 'large-scale distillation attack' affecting ~1.4% of Console users (those who had linked an external provider) and said it was working with the three labs; no actor, attack model or total loss has been established.
Why it matters
A copied provider API key is a bearer credential: an attacker can run billable requests, exhaust quota, and resell the key for model distillation on the victim's account, bypassing Console budget controls (which only cap traffic through OpenCode's own gateway). This is a single point of failure for centralising AI credentials and an in-window example of AI-provider credential theft in the agent-development supply chain — distinct from the local OpenCode MCP RCE.
Attack vector
Unauthorized access to a decommissioned legacy system where Console stored third-party AI provider API keys; attackers then invoked the providers' APIs under victims' identities/quota
Affected systems
OpenCode Console (Anomaly) — hosted AI coding agent workspace service; users with linked OpenAI/Anthropic/Google provider keys
Mitigation
Revoke and rotate the exposed key at the issuing provider (OpenAI/Anthropic/Google), review usage/billing back to Oct 16, set spend limits, and decommission credential-bearing legacy systems; OpenCode is working with the three labs to remediate