OpenCode Security Breach Exposes API Keys as Hackers Run Up $1,700 in Unauthorized Charges
OpenCode suffered a security breach affecting 1.4% of Console users, exposing API keys for OpenAI, Anthropic, and Google. Attackers exploited the compromised keys in what the company called a large-scale distillation attack, leaving some users with unauthorized charges exceeding $1,700 while the team struggled with AI safety filters blocking their own defensive analysis.