OpenCode Says a Console Breach Exposed Linked Anthropic, OpenAI and Google API Keys Used in a Distillation Attack
OpenCode disclosed a breach of its hosted Console that affected 1.4% of Console users who had linked external providers, with earliest exposure at 00:30 UTC on Oct. 17, BleepingComputer reported. Some victims were charged up to $1,700. Co-founder Dax Raad said attackers targeted the company for at least 48 hours in a distillation attack.
Stolen API keys are now being burned for frontier-model outputs at someone else's expense. BleepingComputer reported on Monday, October 19 that OpenCode, the open-source coding-agent project, disclosed a breach of its hosted Console. It affected 1.4% of Console users who had linked external providers such as Anthropic, OpenAI and Google, with the earliest exposure at 00:30 UTC on October 17. Some victims were charged up to $1,700, and some Google Cloud projects were suspended.
Co-founder Dax Raad said attackers had targeted the company for at least 48 hours in what he described as a distillation attack, and that OpenCode's own models refused to help with defensive analysis until it switched to OpenAI's Daybreak cybersecurity model. OpenCode mentioned possible reimbursement. We covered Anthropic's anti-distillation measures and Daybreak separately.
Limits
- OpenCode's X post is quoted via BleepingComputer. Unverified search-snippet claims about a legacy system and locally stored keys are omitted.