OpenCode breach exposes users' AI keys, runs up charges
Hackers broke into an older system at the AI coding tool OpenCode and exposed API keys stored by 1.4% of its Console users. Some users reported hundreds or even more than $1,700 in charges overnight. OpenCode says refunds for the charges are underway.
Attackers broke into an older system at OpenCode, an open-source AI coding tool, and exposed the API keys some users stored to reach outside AI services, TechCrunch and BleepingComputer reported. The breach hit 1.4% of users of its online platform, OpenCode Console.
"We had a security breach last night related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users," the company wrote on X on Saturday. It said it emailed everyone affected. Users who did not get an email were not affected.
Developers soon posted spending alerts and surprise charges on Reddit and X, TechCrunch reported. Some saw charges in the hundreds of dollars, and a few said totals topped $1,000. BleepingComputer reported that some users saw more than $1,700 in unauthorized charges overnight, and that some had projects suspended in Google Cloud.
Anthropic and Google blocked the keys they believed were exposed, TechCrunch reported. OpenAI said it worked with OpenCode to restore access and refund its customers. OpenCode said refunds for unauthorized charges are underway. Its open-source app and command-line tool were not affected, co-founder Dax Raad said.
Distillation is a real machine-learning method for training smaller models on the answers of bigger ones, BleepingComputer explained. It becomes an attack when it relies on large volumes of unauthorized queries. Leaked keys can help users in countries with limited access to American models generate that volume, TechCrunch reported.
Not everyone accepts OpenCode's framing. Some skeptics said it was a plain breach and that any use for distillation is unproven, TechCrunch reported.
Raad said attackers had targeted OpenCode's systems for at least 48 hours using AI agents, BleepingComputer reported. He said OpenCode's own probe stalled when the AI models it used refused requests because of built-in safeguards. Things steadied after OpenCode was approved Saturday to use OpenAI's Daybreak cybersecurity model for defense, he said.
What we know: Keys from 1.4% of Console users were exposed, leading to charges that are being refunded.
What we don't: Who carried out the attack and whether the keys were really used for distillation.
Where outlets agree TechCrunch and BleepingComputer both report that the breach hit 1.4% of OpenCode Console users and that OpenCode blamed a large-scale distillation attack.
Where they differ OpenCode calls it a distillation attack, while skeptics cited by TechCrunch say it was a straightforward breach and the distillation use is unproven.