OpenCode confirmed a security vulnerability linked to a large-scale distillation attack, affecting 1.4% of its Console users. Third-party API keys from OpenAI, Anthropic, Gemini and other services stored in user workspaces may have been exposed, with attackers draining credits for model training. Users reported unauthorized charges of $400 to $1,700. OpenCode has alerted users, and Anthropic has forcibly revoked all suspected leaked Claude API keys.