OpenCode security breach exposes API keys of major AI providers

OpenCode disclosed a security breach on October 16, affecting 1.4% of its users. The incident involved a 'distillation attack' that compromised an outdated system in the process of being decommissioned. Affected users, who had linked external service providers, were notified via email on October 17. The breach potentially exposed API keys for OpenAI, Anthropic, and Google, allowing unauthorized access and generating unexpected charges. One user reported a $400 unauthorized charge on their Anthropic account, while another noted a €200 charge on Google services, with their project suspended for 'abuse'. Some users received alerts from OpenAI and Anthropic before being notified by OpenCode. The company is collaborating with these firms to address the issue. Users also noted receiving usage alerts from OpenAI and Anthropic prior to OpenCode's official notification. OpenCode emphasized that only users connected to external services were impacted, and those who did not receive an email were unaffected. The company has not disclosed further details, as the incident is still under investigation.