Anomaly Innovations disclosed on October 17, 2026, that attackers breached its OpenCode Console platform and hijacked stored API keys belonging to roughly 1.4% of Console users1,2. The keys connected to models from Anthropic, OpenAI, and Google.
The company described the incident as a "large scale distillation attack". Attackers exploited vulnerabilities in a legacy system to gain unauthorized access to API keys stored in user workspaces, then ran repeated queries against high-end AI models using the stolen credentials. Affected users reported account balances draining rapidly, with some bills climbing into the hundreds of dollars.
How the attack worked
The attackers were not pursuing passwords or payment information. They targeted access to expensive AI model endpoints, offloading compute costs onto the compromised users' accounts. The term "distillation attack" points to a specific objective: using a powerful model's outputs at scale to train or refine a separate, cheaper model. ANALYSIS Running high-volume queries against frontier models through stolen keys is consistent with knowledge-distillation workflows, where an attacker extracts a target model's behavior by collecting large numbers of input-output pairs.
OpenCode, an open-source AI coding platform built by Anomaly Innovations, said it is working with Anthropic, OpenAI, and Google on remediation. The company advised affected users to rotate or revoke their API keys immediately.
Broader agent-security context
The breach lands the same day India's CERT-In confirmed that AI agents had penetrated Indian firms and operated undetected for days, an incident that prompted Rubrik to warn that AI agents are accelerating the speed at which vulnerabilities are discovered and exploited[1]. Separately, Vector Wire's recent analysis of the agentic AI stack flagged the control plane, the layer that governs whether an agent's proposed action is permitted, as persistently underbuilt across the industry[2].
ANALYSIS The OpenCode incident illustrates a concrete failure mode in that underbuilt layer: stored third-party credentials sat in user workspaces without sufficient access controls, and a legacy system provided the entry point. The attack surface grows as more coding agents and developer tools store API keys for multiple upstream model providers in a single console.
OpenCode has not disclosed the total number of affected accounts or the aggregate financial impact beyond individual bills reaching hundreds of dollars.