Anomaly Innovations, the company behind the OpenCode developer tool, began emailing users late on Oct. 17 that OpenAI, Anthropic and Google API keys stored in OpenCode workspaces may have been exposed through a legacy console it was decommissioning. The earliest exposure it could identify was roughly 22 hours before that first notice. Two users have reported unauthorized Claude API usage and about $100 in fraudulent charges.
For the many Malayalee software professionals in South Florida who use AI coding tools, the next step is specific: revoke and reissue every affected key directly in each provider's own dashboard — not through links in the notification email — then review billing and usage logs back to Oct. 17 and set spending limits on new keys.
Treat any unexpected "security notice" email itself with caution, and go to the provider site directly. The full scope of the exposure has not yet been independently confirmed beyond the company's notice and user reports.
