AI SecurityAI GovernanceIncident Response
OpenCode, the open-source AI coding agent, has told a subset of its users that third-party provider API keys saved in their workspaces may have been exposed after unauthorised access to a legacy system. The vendor, Anomaly Innovations, said on 17 October that the incident was "related to a large scale distillation attack that impacted 1.4% of OpenCode Console users", according to Startup Fortune. It is working with Anthropic, OpenAI and Google on remediation.
The number of affected accounts, how the attacker got in, and whether every stored key was actually extracted have not been disclosed. OpenCode says it cannot share more while the investigation is ongoing.
OpenCode has had three unrelated security advisories this year, including CVE-2026-22812 and CVE-2026-22813 in January. The CyberSec Guru notes none of them explains this credential exposure, so do not assume updating the client fixes it. Rotating the keys is the fix.
Most stolen-API-key stories are about free compute: someone resells access or runs a spam campaign on your bill. Distillation is different. The attacker sends a very large number of carefully chosen prompts to a frontier model and keeps the answers to train a cheaper model to imitate it. The output is the point, not the service.
That makes stolen keys from real organisations more valuable, not less. Anthropic has already alleged that three China-based labs generated more than 16 million exchanges with Claude through about 24,000 fraudulent accounts, as reported by Infosecurity Magazine, using proxy networks to evade detection. Providers have responded by tightening account vetting. A key belonging to an established paying customer gets around that vetting entirely, and the traffic looks like a legitimate team doing a lot of coding.
The OpenCode label is the vendor's description of the motive, not an attribution. Nobody has publicly said who ran the queries.
OpenCode did nothing unusual by storing provider keys. Every AI coding tool, agent framework and chat front-end that lets you "bring your own key" does the same, and each one becomes a place where that key can be lost. A single OpenAI or Anthropic key typically carries the full spend limit of the account, works from any IP, and can call any model the account can reach. Lose it from one tool and you have lost it everywhere.
We saw the same shape in the GitLab AI Gateway flaw earlier this month, where the vulnerable component held provider credentials for an entire platform. The difference here is that the keys belonged to individual developers and teams who pasted them into a vendor's hosted console, which is exactly how most organisations' AI spend is wired up today.
The sixth step above is the one teams skip, because every new tool asks for a provider key and there is no central place to issue something narrower. That is what Obiguard Governance AI is for. The provider key stays in the gateway. Each coding agent, workspace or tool gets its own access key scoped to a specific agent, bound to an approved provider and an approved list of models, so a key issued for one agent cannot be used to reach another or to call a model it was never meant to use.
If a key like that leaks from a third-party console, you revoke one key in one place and the provider credential behind it is untouched. Usage is attributable per agent on the project dashboard, so a traffic spike shows up against the tool that caused it rather than as an unexplained jump on three separate provider bills, and the audit ledger records what was sent and what came back. For a distillation attempt, that is also where the pattern is visible: thousands of structured prompts from one key, at a volume no developer produces by hand.
How many separate tools and consoles currently hold a copy of your organisation's OpenAI or Anthropic key, and could you name them all before you had to rotate it?
See how Governance AI works or talk to us about moving from shared provider keys to per-agent access.
Obiguard sits in front of every AI request your organization makes — screening prompts and outputs against the guardrails, compliance frameworks, and audit trails that stories like this one make necessary.
See how it works →