OpenCode breach exposes users' linked AI provider API keys during large-scale distillation attack, causing unauthorized charges
The open-source AI coding agent OpenCode disclosed a breach tied to a "large-scale distillation attack" that exposed stored external-provider API keys for 1.4% of OpenCode Console users. Affected users had linked providers such as Anthropic, OpenAI and Google. Users reported unauthorized charges ranging from several hundred USD to more th…