What happened
Anomaly Innovations said unauthorized access to a legacy system it was retiring may have leaked OpenAI and Anthropic API keys stored in OpenCode Console workspaces, with OpenCode putting the affected share at 1.4% of Console users.
Why it matters
Users whose keys sat in those workspaces face possible unauthorized use of their AI accounts, so affected Console users are being told to invalidate and reissue keys — regular OpenCode app users are not affected.
WHO IT HITSDevelopers and small teams who connected external AI providers through OpenCode Console are the ones exposed; those who only use the standalone OpenCode app are unaffected, per OpenCode.
Summaries like this, in your inbox every morning.
The incident centers on OpenCode Console, an online service separate from the regular OpenCode app, which users rely on to connect external AI providers. According to the notice to users, API keys for OpenAI and Anthropic stored in Console workspaces may have leaked after unauthorized access to a legacy system that was being retired. OpenCode framed the event on its official X account as a security breach tied to a large-scale distillation attack and said all affected users were notified by email.
On the response side, Anthropic's Lydia Hallie said on October 18, 2026 that Anthropic is working with OpenCode and has already revoked Claude API keys believed to be affected, and OpenCode developer Dax posted the same day that attackers had been trying nonstop for the past 48 hours, hardening systems as a side effect while arguing defenders need agents running around the clock too. OpenCode says it is coordinating with Anthropic, OpenAI and Google, but because the problem is ongoing it is not sharing details, so how the intrusion happened and how far the damage reaches are likely to become clearer as the investigation proceeds.
Pick your industry and the AI tools you use, and get news related to your work every day.
Free · 30 seconds with Google · unsubscribe anytimeWhat is AIToday? →
Ask AI anything about this article. The AI reads this article, earlier AIToday articles, and Wikipedia, and cites its sources. Q&As are published on this page for other readers too.
Anthropic, developer of Claude, committed 5% of its shares to a new public benefit fund, with an extra 2% per…
DeepSeek published DeepSeek-V4.1-Flash-1017 on October 17, 2026 as a free, MIT-licensed open model that scored…
DeepSeek released DeepSeek-V4.1-Flash-1017, a “minor update” that reduces task execution time and output lengt…
Simon Willison shipped llm-echo 0.5, a debug plugin whose "echo" model involves no LLM at all and just repeats…
PitchiPT, a physical therapist of over 10 years, started full-scale AI-assisted programming around June 2026 a…
VS Code's documentation says prompt files are deprecated for Agent Host sessions and aren't loaded there, thou…
