OpenCode says API keys were exposed in a distillation attack
Only users with linked external providers were affected, and some saw unauthorized cloud charges or project suspensions.
OpenCode says a large-scale distillation attack exposed stored API keys for a small slice of its users, and the incident led to unauthorized cloud charges and, in some cases, suspended Google Cloud projects. The company says 1.4% of OpenCode Console users were affected, with impacted users getting email notices and the earliest possible key exposure pegged to October 17, 2026 at 00:30 UTC. OpenCode said the attackers had been probing its systems for at least 48 hours and that its own investigation was hampered when the AI tools it relied on started refusing requests under their safety rules. The project is now working with Google, OpenAI, and Anthropic, and its notice says no data appears to have been exposed while reimbursement may be possible for those hit by charges.
Why it matters
For affected OpenCode Console users, the incident means stored keys tied to external providers may need to be treated as compromised, not just the service account that was hit. The reported charges and suspended Google Cloud projects show the impact can reach beyond OpenCode itself into connected cloud services, while the company’s work with Google, OpenAI, and Anthropic suggests the response now spans multiple vendors.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.
Sources
- BleepingComputer