OpenCode discloses key theft incident, approximately 1.4% of Console users affected

OpenCode disclosed a security incident, saying it is related to a large-scale distillation attack, affecting approximately 1.4% of OpenCode Console users. Those affected are a subset of users who had bound external service providers. The company notified them individually by email the next morning. OpenCode said the incident is still being handled, and it is working with Anthropic, OpenAI, and Google to fix it, without disclosing more details. A poster who forwarded the message and reminded users to rotate their keys said that Anthropic and Google have confirmed that some Claude and Gemini API keys were leaked and are assisting with handling. One user had $1,700 stolen. The poster advised anyone who has used OpenCode to immediately revoke old keys, generate new ones, and check API bills for any unusual charges.