Key points
- Anomaly Innovations confirmed a breach impacting approximately 1.4 per cent of OpenCode Console users.
- The incident involved a large-scale distillation attack targeting stored OpenAI API keys.
- The company behind the open-source coding agent OpenCode disclosed the security event.
Anomaly Innovations has disclosed that a security incident compromised the API keys of a subset of its customers. The breach affected approximately 1.4 per cent of users of the OpenCode Console service. According to Startup Fortune, the attack involved a large-scale distillation method. The company stated that stored OpenAI keys were exposed during the event. This disclosure highlights risks associated with AI coding tools that store third-party credentials.
In plain English
A distillation attack typically involves an adversary extracting data or model weights from a system. In this context, the attacker targeted the storage mechanisms of the OpenCode Console. The goal was to retrieve sensitive authentication tokens, specifically OpenAI API keys. These keys allow access to external AI services. The breach did not affect all users, but the exposed credentials could be misused.
The background
Anomaly Innovations is the developer behind OpenCode, an open-source coding agent. The company operates a console service that interacts with AI models. Users provide API keys to enable these interactions. The recent incident was reported by Walter Schulze at Startup Fortune. The outlet described the event as a large-scale distillation attack. This terminology suggests a sophisticated approach to data extraction from the service infrastructure.
What changes now
Anomaly Innovations has publicly acknowledged the breach. The company specified the percentage of affected users. This transparency allows impacted customers to assess their risk. Users who had their keys exposed must now consider those credentials compromised. They should rotate their API keys to prevent unauthorised access. The incident serves as a reminder of the security responsibilities of AI tool providers.
The attacker's path
Teams usually monitor for unusual data extraction patterns in AI services. Check whether your organisation uses coding agents that store third-party keys. Ensure that access logs are reviewed for anomalies. Verify that credential storage follows best practices for encryption. Consider limiting the scope of API keys used in development tools. Regular audits of integrated services can help identify potential exposure vectors before they are exploited.
What to do and how to stay safe: OpenCode
- Rotate any OpenAI API keys that were stored in the OpenCode Console immediately.
- Review access logs for your AI services to detect unauthorised usage.
- Implement stricter permissions for API keys used in development environments.
- Monitor for unexpected charges or activity on linked AI service accounts.
Step-by-step guide: Phishing vs Spam: How to Tell the Difference and Stop Threats
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many users were affected by the OpenCode breach?
Anomaly Innovations stated that approximately 1.4 per cent of OpenCode Console users were impacted.
What type of attack was used?
The company described the incident as a large-scale distillation attack, according to Startup Fortune.
What data was exposed?
Stored OpenAI API keys belonging to the affected users were exposed during the breach.
