OpenCode Security Breach Exposes API Keys of 1.4% Console Users

OpenCode, an AI coding tool, has confirmed a security vulnerability related to large-scale distillation attacks, affecting approximately 1.4% of its Console users. The breach originated from a legacy system that was scheduled to be decommissioned.

API keys for OpenAI, Anthropic, Gemini and other third-party services stored in users' workspaces may have been exposed. Attackers reportedly used these keys to generate high-quality tokens from top-tier models for training their own models, leading to abnormal charges on affected accounts. Some users reported losses ranging from $400 to over $1,700.

OpenCode has sent email alerts to affected users and is coordinating with Anthropic, OpenAI and Google. Anthropic's Lydia Hallie stated that all suspected leaked Claude API keys have been forcibly revoked. OpenCode co-founder Dax Raad also said his personal account was attacked.

Security experts urge affected users to immediately revoke and rotate their API keys in the official consoles of the respective model providers, as changing passwords alone will not invalidate exposed keys. Users should also review recent usage and billing statements, preserve evidence of abnormal activity, and contact providers for investigation and refund requests.