Anomaly Innovations, the company behind OpenCode, confirmed a breach exposing OpenAI, Anthropic, and Google API keys for roughly 1.4% of its users, prompting an urgent key rotation.
TL;DR
- OpenCode breach exposed API keys for 1.4% of users, affecting OpenAI, Anthropic, and Google credentials.
- The incident highlights the risks of storing sensitive keys in third-party systems, with developers reporting unexpected charges and account suspensions.
- Anomaly Innovations is working with the affected companies to remediate the incident, but many questions remain unanswered.
What happened
Anomaly Innovations, formerly known as SST, announced a breach on October 17 that exposed API keys stored in OpenCode, its open-source coding agent. The breach impacted roughly 1.4% of OpenCode Console users, affecting those who had linked external providers like OpenAI, Anthropic, and Google to their accounts.
The company described the incident as a 'large-scale distillation attack' and notified affected users via email. However, the term 'distillation attack' has been questioned, as it typically refers to model training rather than key exposure. The company has not provided further details on the attack method.
Developers reported unexpected charges on their OpenAI and Anthropic bills, and some even had their Google Cloud projects suspended or OpenAI accounts deleted due to the incident. Anomaly Innovations has not confirmed whether the exposed keys were used maliciously or how many accounts were affected.
Why it matters
This incident underscores the risks of storing sensitive API keys in third-party systems, especially those not designed with robust security measures. OpenCode's documentation already warns about the lack of sandboxing, but this breach highlights the potential consequences of such design choices.
For developers and startups, this serves as a stark reminder to regularly audit and secure their API keys, set spending limits, and monitor usage logs. The fallout from this breach could have significant financial and operational impacts.
For investors, this incident highlights the importance of due diligence when evaluating AI startups, particularly their approach to security and handling of sensitive data. The long-term reputation and trust in OpenCode and Anomaly Innovations could be at stake.
Key facts
- Roughly 1.4% of OpenCode Console users were affected by the breach, according to Anomaly Innovations.
- The breach exposed API keys for OpenAI, Anthropic, and Google, prompting an urgent key rotation.
- Anomaly Innovations has not confirmed whether the exposed keys were used for malicious activities or how many accounts were affected.
- Developers reported unexpected charges and account suspensions due to the incident, per user reports on social media.
- Anomaly Innovations is working with OpenAI, Anthropic, and Google to remediate the incident, but many details remain undisclosed.
- OpenCode is a terminal-based coding agent that runs with a developer's own credentials, reading files and calling external APIs on their behalf.
- The company's documentation warns that OpenCode does not sandbox the agent, and its permission prompts are a UX feature rather than a security boundary.
- This incident is part of a broader pattern of AI tooling mishandling credentials, with similar issues reported by OpenAI and other firms.
Context
This breach is not an isolated incident. OpenAI itself disclosed a similar issue where one of its research models posted a researcher's GitHub token to a public repository. This led to a customer account compromise at AI infrastructure firm Modal Labs and pushed OpenAI to pause training and inference involving tool use on its most capable models.
JPMorgan's Jamie Dimon has also expressed concerns about the security of AI agents, stating that the bank won't let outside AI agents log into customer accounts or act on their behalf. This defensive line is drawn specifically because of behavior like that seen in the OpenCode incident.
For the developer community, this incident serves as a blunt reminder that a stored key is only as safe as the least-maintained system behind the product holding it. It highlights the need for robust security measures and regular audits of API keys and usage logs.
