Anomaly Innovations, the developer of the OpenCode AI coding agent, reported a security breach on October 17, 2026. Attackers gained access to a legacy system linked to the company's Console product, compromising the API keys of approximately 1.4% of its users.
The stolen keys provided access to services from OpenAI, Anthropic, and Google. Unauthorized parties utilized these credentials for large-scale tasks such as model distillation, resulting in charges for affected users ranging from hundreds of dollars to over $1,000.
In response to the incident, Anthropic and Google revoked the compromised keys. OpenAI collaborated with OpenCode to issue credits to users for the unauthorized charges incurred during the breach.
During the investigation, OpenCode encountered difficulties as AI guardrails prevented frontier models from analyzing the attack code. The company eventually utilized less restricted AI models to complete the analysis, though the delay hindered defensive efforts.
