Open-source AI coding tool OpenCode confirmed a security breach that reportedly affected 1.4% of its Console users. Saved OpenAI and Anthropic API keys may have been exposed, potentially allowing attackers to misuse accounts and generate unauthorized charges.
Some users have already reported unexpected bills, including one Anthropic customer who claimed to have been charged $400.
OpenCode linked the incident to a large-scale AI distillation attack, in which attackers attempt to extract responses from advanced AI models to train competing systems.
During the investigation, some AI models used to analyze the attack reportedly refused requests because their safety filters flagged the security-related work. A similar issue was also reported by Hugging Face.
OpenCode says it has since joined a trusted-access program for security defenders and improved its response process.
If you received a breach notification, take these steps:
- Revoke exposed OpenAI and Anthropic API keys and generate new ones.
- Update the replacement keys in every application that uses them.
- Review recent API usage and billing for unauthorized activity.
- Watch for scammers impersonating OpenCode or its support team.
OpenCode says users who did not receive a breach notification were not affected. If you use the platform, check your official account communications for confirmation.
