OpenCode breached: API keys of 1.4% of Console users leaked and abused

OpenCode said Saturday that attackers breached an older system the previous night, affecting 1.4% of users on OpenCode Console, where some users stored API keys for accessing AI services. All affected users were notified by email; no email means no impact. Co-founder Dax Raad stressed that only Console was affected, the open-source app and CLI were not, and keys never reach OpenCode. Developers posted billing alerts on Reddit and X, some reporting simultaneous OpenAI, Anthropic, and Google AI alerts, with hundreds of dollars charged per account and a few over $1,000. Anthropic and Google banned keys they deemed compromised; OpenAI said it worked with OpenCode to restore access and refunded affected API customers for usage consumed in the attack. OpenCode said refunds for unauthorized charges are underway. OpenCode described the incident as a large-scale distillation attack but did not explain how it happened or how keys were stored. Skeptics call it an ordinary breach, and the distillation claim is unverified. Affected users were told to revoke and rotate keys directly with providers; the company says the incident is still being handled.