The open-source AI coding project OpenCode alerted users to a security breach where stored API keys for external providers were exposed. This incident has led to unauthorized API charges and the suspension of some user projects, based on information published by Bleeping Computer.
OpenCode, an AI coding agent that helps developers with tasks like understanding code, writing features, and fixing bugs, experienced a large-scale distillation attack. This attack specifically impacted about 1.4% of its users who had linked external AI providers such as Anthropic, OpenAI, and Google. Distillation, a machine-learning technique used to train smaller AI models with responses from larger ones, was exploited for unauthorized queries. Attackers targeted OpenCode's systems for at least 48 hours, with the earliest exposure of user keys dating back to Oct. 17, 2026. Users reported unauthorized charges ranging from several hundred to over $1,700, and some experienced Google Cloud projects being suspended due to detected abusive activity. OpenCode is working with the affected AI providers and has mentioned the possibility of reimbursement for those impacted.
Source: Bleeping Computer
