Security · Updated 20 Oct, 12:58 am IST

OpenCode breach exposed stored API keys, affected 1.4% of Console users

Why it matters for readers: It explains how attackers can use leaked API keys to run services and create unexpected costs for users.

OpenCode said a large distillation attack breached an older system and impacted 1.4% of OpenCode Console users.1 2
The breach exposed API keys that users had stored for external providers such as Anthropic, OpenAI, and Google, and led to unauthorized charges for some users.1 2
Some developers reported seeing spending alerts and suspended projects in Google Cloud after the incident.1 2
OpenCode is an open-source, model-agnostic AI coding agent used via terminal, desktop app, or code editor that lets users connect multiple AI providers.1
Observers noted questions about whether the breach was used specifically for distillation, with some calling that framing unproven.2

Get a brief like this every morning

Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.

19 Oct, 10:57 pm · BleepingComputer
OpenCode hack exposes API keys amid AI distillation attacks
20 Oct, 12:58 am · TechCrunch AI
Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts