OpenCode discloses breach exposing users' OpenAI, Anthropic and Google API keys
OpenCode says a late-Friday intrusion tied to a large-scale distillation attack exposed provider API keys for 1.4% of its Console users; the firm says it is working with Anthropic, OpenAI and Google.
OpenCode, the open-source terminal-based AI coding agent, has disclosed a security breach that exposed the API keys of a subset of its users, the company said on Saturday.
“We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users,” the project’s X account posted on Saturday afternoon, adding that all affected users had been notified by email.
According to The Latent, the breach late on Friday (16 October) gave an attacker “unauthorized access to a legacy system that we were in the process of decommissioning,” exposing OpenAI, Anthropic and Google provider keys saved in some users’ Console workspaces. OpenCode says it is working with Anthropic, OpenAI and Google to remediate the incident, but has not disclosed how the attackers got in or confirmed whether the exposed keys were misused.
Before the disclosure, users reported unexplained charges. Colin Parsons wrote on X that his OpenAI key had been “pounded” for $281 of usage and his Anthropic key for $168; Preston Zeller put his losses at $1,700. The Latent said it could not independently verify those reports.
OpenCode co-founder Dax Raad said his personal accounts were also being attacked, calling it “a whole new world with AI-powered hacking.”
More on this topic: all Technology stories
