OpenCode: 1.4 per cent of console users affected by a large-scale ‘distillation attack’

Stolen API keys were used to generate charges without customers’ knowledge. OpenCode is calling for them to be revoked and is coordinating a response with Google, OpenAI and Anthropic.

The editor of the OpenCode programming agent e-mailed a part of its console users on 17 October: 1.4% of them saw their API IDs compromised. Several clients had first noticed user bills that they did not explain. The company describes the incident as a "large-scale distillation attack"—the stolen keys were likely used to interview large-scale models at victims' expense.

The instructions are clear: immediately revoke API keys and change password. OpenCode indicates working with Google, OpenAI and Anthropic to limit damage, but specifies that the incident is still ongoing and that it cannot say more until the remediation is completed.