OpenCode Reports API Key Leak After Security Breach
AI development platform OpenCode has announced a security incident involving a "distillation attack" that resulted in the leak of API keys for a portion of its users. The breach affected 1.4% of users and may lead to unauthorized charges.
AI development platform OpenCode has reported a security incident that led to the exposure of API keys for some of its users. The company stated the event, described as a large-scale "distillation attack," impacted 1.4% of OpenCode Console users.
OpenCode notified affected users via email on October 17, local time. The leaked API keys, including those linked to external providers like OpenAI and Anthropic, could potentially be used to make unauthorized requests and incur charges in the users' names.
The company is collaborating with OpenAI, Anthropic, and Google to address the situation. The breach is believed to have occurred due to unauthorized access to an older, decommissioned system.
Multiple users have reported unexpected charges on their service accounts following the incident. One user cited unauthorized debits of $400 on their Anthropic account, while another reported their Google services usage reached approximately €200, leading to account suspension for "excessive abuse."