OpenCode, an open-source AI coding agent, disclosed a security breach affecting 1.4% of its OpenCode Console users on Saturday. The breach allowed attackers to access stored API keys, which are digital passwords for AI services, leading to unauthorized charges on users' AI accounts. The company notified all impacted users via email, confirming that those who did not receive an email were unaffected, according to techcrunch.com.
The breach occurred overnight through what OpenCode described as a large-scale distillation attack, though the company did not detail the exact method. API keys leaked in the attack enabled unauthorized use of AI services from providers like OpenAI, Anthropic, and Google AI. Developers reported unexpected spending alerts and charges on social media platforms such as Reddit and X as the attack unfolded. Some critics questioned the characterization of the incident as a distillation attack, suggesting it was a straightforward breach without confirmed use for distillation, per techcrunch.com.
This incident highlights the challenges faced by companies offering AI tools without fully vetted access controls or safety restrictions. OpenCode has been gaining popularity as an alternative to Claude Code and Cursor, but the breach underscores vulnerabilities in securing API keys that grant access to powerful AI models. The attack also illustrates the risks of AI-driven cyberattacks that can rapidly exploit exposed credentials to generate high volumes of outputs, raising concerns about security in the expanding AI development ecosystem, according to techcrunch.com.
OpenCode's response included notifying affected users and working to contain the breach. The company confirmed that only 1.4% of its OpenCode Console users were impacted. The incident was publicly disclosed on Saturday, with ongoing monitoring to prevent further unauthorized access, as reported by techcrunch.com.