OpenCode, an open-source AI coding agent, reported a security breach on Saturday that affected 1.4% of its users on the OpenCode Console platform. This incident occurred overnight and involved unauthorized access to an older system where some users stored their API keys, which are essential for accessing various AI services.
Incident Overview
The company stated, "We had a security breach last night related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users." Notifications were sent out to affected users via email, while those who did not receive an email were assured they were not impacted.
While the specifics of the distillation attack remain unclear, it is believed that leaked API keys could enable users in regions with restricted access to American AI models to generate the necessary outputs for such processes. Some users expressed skepticism about the company's framing of the incident, suggesting it was a straightforward breach without proven links to distillation.
User Reactions and Financial Impact
Developers took to platforms like Reddit and X to report unauthorized charges on their accounts. One developer noted, "I saw my Open AI, Anthropic, and Google AI spend alerts all fire off before going to bed wondering what was going on." Reports indicated that some users faced charges in the hundreds, with a few exceeding $1,000.
In response, Anthropic and Google blocked the exposed API keys, while OpenAI collaborated with OpenCode to restore access and refund affected customers for credits used during the attack. OpenCode confirmed that refunds for unauthorized charges are currently being processed.
