OpenCode breach: AI API keys exposed, users report charges

OpenCode, the open-source AI coding agent that lets developers plug in models from different providers, has confirmed a security breach. In a post on X on Saturday, the company said the incident was related to a "large scale distillation attack" and affected 1.4% of OpenCode Console users. The people hit were a subset of users who had external providers linked, and all of them were notified by email. OpenCode said users who did not get an email were not affected.

What was exposed

According to the email, reported by Notebookcheck, someone gained unauthorised access to a legacy system OpenCode was in the process of decommissioning. Third-party API keys stored in users' workspaces, including keys for OpenAI and Anthropic, may have been exposed. An API key works like a prepaid card for an AI service: whoever has it can send requests, and the owner pays.

That is exactly what some users say happened. In a Reddit thread cited by Notebookcheck, one person reported $400 in unauthorised Anthropic charges. Another said Google usage charges had reached about €200 and their project had been suspended for abuse. One commenter received usage alerts from OpenAI and Anthropic before OpenCode's notice arrived. Some users also reported trouble signing in to OpenCode afterwards.

"Distillation" means collecting a large number of answers from an AI model to train another model. OpenCode's wording suggests the stolen keys were used to make such requests at victims' expense, but the company says the incident is still ongoing and it cannot share more yet. It is working with Anthropic, OpenAI and Google to fix the problem.

What to do if you use OpenCode

Even if you weren't affected, it is a good moment to check where your AI keys live. Coding tools are moving fast, as Replit's recent switch of default models shows, and every service you hand a key to is another place it can leak. For some work, running a model locally avoids that entirely; our guide to buying a laptop for local AI explains what hardware you need.