An AI Coding Tool Was Breached. If You Linked an OpenAI, Anthropic or Google Account to Any AI Tool, Do These Five Things.

On 18 October OpenCode, an open-source AI coding agent, told users it had a "security breach last night related to a large scale distillation attack." It affected 1.4% of OpenCode Console users, specifically those who had linked an external AI provider: Anthropic, OpenAI or Google. OpenCode emailed the affected users that morning and said it was working with all three providers. At the time of writing it had not published a root cause or said what was accessed.

You may never have heard of OpenCode. The lesson is not about one tool.

Why a linked AI account is worth stealing

When you link your OpenAI, Anthropic or Google account to a tool, or paste an API key into it, that tool can now use the AI on your account, at your cost. Whoever gets hold of that access can do the same.

A "distillation attack" usually means using someone else's access to a strong model to generate large amounts of answers, then using those answers to train a different model. It needs a lot of AI usage, and AI usage costs money. Stolen keys pay that bill. OpenCode has not explained exactly how the term applies in its case, so treat that as background, not as a description of what happened.

The same week, researchers looking at a campaign of AI agents attacking websites found hundreds of credentials and API keys exposed on the attackers' own control panels, and about one in nine still worked. Keys leak from all directions: from tools, from code, from shared documents, from the people misusing them.

What OpenCode users should do now

If anyone on your team uses OpenCode, the security firm StepSecurity recommends:

• Check email for OpenCode's notification. OpenCode says users who did not get one were not affected.
• Look at which providers are linked. On a Mac or Linux machine the file is ~/.local/share/opencode/auth.json. On Windows it is %USERPROFILE%\.local\share\opencode\auth.json.
• Replace (rotate) every Anthropic, OpenAI or Google key that was linked to OpenCode or its Console.
• Check each provider's usage page for requests nobody on your team made.

Five things for every business that uses AI keys

Most small businesses have more AI keys in circulation than they think: one in the website chatbot, one in an automation tool, one in a spreadsheet add-on, one a developer pasted into a coding assistant, one in a browser extension somebody tried last year. These five steps take an afternoon:

1. Make a list of every place a key lives. Go through each AI provider's dashboard: OpenAI, Anthropic, Google and any others. Most show every key with its name and when it was last used. Next to each one, write which tool uses it. Any key nobody can explain should be deleted.
2. Use one key per tool. If the chatbot, the automation and the developer all share one key, a leak in any of them means changing it everywhere, and you cannot tell which one leaked. Separate keys let you switch off one tool without breaking the others.
3. Set a spending limit and an alert at the provider. Every major provider lets you cap monthly spend or get an email at a threshold. Set the alert at about twice your normal month. A stolen key then becomes a warning email, not a surprise invoice.
4. Delete keys for tools you no longer use. The tool you tried for a week in the spring still holds a working key unless you remove it. Revoking takes one click.
5. Keep keys out of code, browsers and shared documents. A key belongs in a server setting or a secret store that only the tool can read. A key in a website's front-end code, a shared spreadsheet or a chat message should be treated as already public and replaced.

If you build with AI coding agents

Coding agents need broad access to be useful: your files, your terminal, often your cloud accounts and AI keys. That makes them a good place for an attacker to stand. We wrote earlier about coding agents publishing private screenshots to public GitHub. The habit that helps in both cases is the same: give the agent its own key with a spending limit, keep production credentials off the machine it runs on, and look at what it did before trusting it with more.

Sources

• StepSecurity, OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers, 18 October 2026. OpenCode's statement, the 1.4% of Console users with linked Anthropic, OpenAI or Google providers, the email to affected users, the incident being ongoing, the auth.json locations and the recommended response steps.
• TNW, AI agents broke into 100+ sites for one hacker at $50 each, researcher says, 19 October 2026. Credentials and API keys exposed on attackers' control panels, 11% verified as valid.