OpenCode suffers a breach: 1.4% of Console users may have had AI keys exposed
Redacción IvokaOct 19, 10:30 AM 3 min
Open-source platform OpenCode reported an attack that may have exposed API keys saved by some users. If you use them, revoke and replace them.
OpenCode, an open-source platform for coding with AI agents, reported a security breach on October 17 tied to a large-scale "distillation" attack. It affected 1.4% of its Console users, a subset who had external AI providers linked. The company said it emailed all affected users; if you didn't get an email, you weren't affected.
What may have been exposed: third-party API keys saved in affected workspaces. According to Cryptobriefing, attackers exploited a legacy system to hijack keys for Anthropic, OpenAI and Google models, and some users got bills in the hundreds of dollars. Cybersecurity News clarifies that the notice describes possible exposure and doesn't confirm every key was stolen or used.
What to do if you use OpenCode: the notice asks you to revoke and replace keys through each provider's dashboard, update the apps that use them and review recent usage for unexpected activity. OpenCode said it is working with Anthropic, OpenAI and Google.
A general reminder: an "API key" is like a password that lets you use an AI service and be billed for it. If you store keys in third-party tools, set spending limits in each provider's dashboard and rotate them if anything looks off.
OpenCode's public statement does not explain how attackers got in, how long they stayed or how many keys were involved.
Sources
