OpenCode hack exposes API keys amid AI distillation attacks

The open-source AI coding project OpenCode has notified some users that stored API keys they used with external providers were exposed in a security breach.

Multiple users reported that the incident led to unauthorized API charges and suspended projects in Google Cloud.

According to the project maintainer, the breach affected 1.4% of OpenCode Console users, with some reporting more than $1,700 in unauthorized charges overnight.

OpenCode is a model-agnostic AI coding agent that helps users understand code, write features, and fix bugs using natural-language instructions, through a terminal, desktop app, or code editor.

Users can connect AI models from multiple AI providers to the OpenCode console to streamline and automate the development process.

On Saturday, OpenCode announced that it suffered a large distillation attack that impacted only developers who linked external providers, including Anthropic, OpenAI, and Google.