/
← Voltar ao feed
high technology software development

OpenCode breach exposes users' linked AI provider API keys during large-scale distillation attack, causing unauthorized charges

1 fonte(s) · 1 atualização(ões) · publicado 19/10/2026 14:27 · coletado há 4 dias

The open-source AI coding agent OpenCode disclosed a breach tied to a "large-scale distillation attack" that exposed stored external-provider API keys for 1.4% of OpenCode Console users. Affected users had linked providers such as Anthropic, OpenAI and Google. Users reported unauthorized charges ranging from several hundred USD to more than $1,700 overnight, and Google suspended some Google Cloud projects for "abusive activity consistent with hijacked resources." OpenCode says the earliest possible key exposure was October 17, 2026, 00:30 UTC, that no other data appears to have been exposed, and that it is working with Google, OpenAI and Anthropic. The article does not state the root cause or the initial access vector.

Detalhes técnicos

  • Co-founder Dax Raad said attackers targeted OpenCode systems for at least 48 hours using AI agents.
  • OpenCode's own investigation was initially hampered because the AI models it used refused requests due to built-in safeguards.
  • The situation reportedly stabilized after OpenCode began using OpenAI's Daybreak cybersecurity model for defensive work.
  • Affected users were notified by email; users who received no email were not impacted.
  • Stolen keys were abused for rogue usage billed to victims' provider accounts.

Remediação

  • Revoke and rotate any API keys linked to the OpenCode Console, especially if an OpenCode notification email was received.
  • Review billing and usage on Anthropic, OpenAI and Google Cloud accounts for anomalies, and set spending limits and alerts.
  • Contact providers about suspended projects. OpenCode's notice mentions possible reimbursement for impacted users.

Linha do tempo

  1. bleepingcomputer.com ↗ · pub. 19/10/2026 14:27 · coletado 19/10 17:53 primeiro registro

    OpenCode breach exposes users' linked AI provider API keys during large-scale distillation attack, causing unauthorized charges

    ler a análise desta fonte

    The open-source AI coding agent OpenCode disclosed a breach tied to a "large-scale distillation attack" that exposed stored external-provider API keys for 1.4% of OpenCode Console users. Affected users had linked providers such as Anthropic, OpenAI and Google. Users reported unauthorized charges ranging from several hundred USD to more than $1,700 overnight, and Google suspended some Google Cloud projects for "abusive activity consistent with hijacked resources." OpenCode says the earliest possible key exposure was October 17, 2026, 00:30 UTC, that no other data appears to have been exposed, and that it is working with Google, OpenAI and Anthropic. The article does not state the root cause or the initial access vector.

    Technical Details

    • Co-founder Dax Raad said attackers targeted OpenCode systems for at least 48 hours using AI agents.
    • OpenCode's own investigation was initially hampered because the AI models it used refused requests due to built-in safeguards.
    • The situation reportedly stabilized after OpenCode began using OpenAI's Daybreak cybersecurity model for defensive work.
    • Affected users were notified by email; users who received no email were not impacted.
    • Stolen keys were abused for rogue usage billed to victims' provider accounts.

    Remediation

    • Revoke and rotate any API keys linked to the OpenCode Console, especially if an OpenCode notification email was received.
    • Review billing and usage on Anthropic, OpenAI and Google Cloud accounts for anomalies, and set spending limits and alerts.
    • Contact providers about suspended projects. OpenCode's notice mentions possible reimbursement for impacted users.