AI coding platform OpenCode hit by breach exposing OpenAI, Anthropic, Google keys
OpenCode says a "large scale distillation attack" hit 1.4% of its Console users. Some report unauthorized charges running into hundreds of dollars.
Symbolic image · Photo: Markus Spiske / Wikimedia Commons, CC0 (cropped and resized)
Open-source AI coding platform OpenCode on Saturday confirmed a security breach, describing it as "a large scale distillation attack that impacted 1.4% of OpenCode Console users." Affected users had linked accounts from outside AI providers such as OpenAI, Anthropic and Google to their workspaces, and those API keys may have been exposed.
The attackers reportedly exploited weaknesses in a legacy system OpenCode was retiring and used the keys to run repeated queries against high-end AI models. Some victims say they were billed hundreds of dollars for usage they did not make. Distillation describes a technique in which one AI model learns by studying the answers of another.
OpenCode has emailed affected users and says it is working with Google, OpenAI and Anthropic on remediation. Security firm Cyera advises revoking or rotating keys and reviewing recent API usage. How the attackers got in has not been disclosed.