Anomaly Innovations Confirms OpenCode Breach Exposed API Keys in Distillation Attack

Anomaly Innovations, the company formerly known as SST behind the open-source terminal coding agent OpenCode, confirmed a security breach linked to a "large scale distillation attack" that impacted roughly 1.4% of OpenCode Console users. The incident exposed stored OpenAI, Anthropic, and Google API keys for a subset of developer workspaces that had linked external providers to their accounts, prompting urgent key rotations across the developer community. Although Anomaly Innovations stated it could not confirm whether the exposed credentials were used maliciously and found no evidence to date that other data leaked, affected developers reported unauthorized charges on their OpenAI and Anthropic bills before receiving the company's notification email. Anomaly Innovations said it notified impacted accounts via email the same morning, is working with the three AI providers to remediate the breach, and advised users to revoke and reissue keys directly through provider dashboards while checking billing logs back to October 17.