OpenCode Hit by Distillation Attack: 1.4% of Users' API Keys Exposed, Some Bills Show Hundreds of Dollars in Anomalous Charges
Attackers breached OpenCode's legacy system through a large-scale distillation attack, hijacking third-party AI provider API keys held by roughly 1.4% of console users, including credentials for OpenAI, Anthropic and Google. Some affected developers spotted hundreds of dollars in unauthorized charges before any alert email reached them.