OpenCode hacked, users' AI accounts charged fraudulently

Attackers breached an older system of the open-source AI coding agent OpenCode, affecting about 1.4% of users of its online platform OpenCode Console; some users' stored API keys leaked and were then fraudulently used, with individual accounts charged hundreds of dollars and a few users reporting more than 1000 dollars. OpenCode said the incident is related to large-scale distillation attacks, and that the leaked keys could help users in countries with restricted access to US models generate the outputs needed for distillation, but skeptics argue this is essentially a data breach and that whether it was used for distillation has not been confirmed. Anthropic and Google blocked keys they believed may have leaked, OpenAI said it has worked with OpenCode to restore access and is refunding API customers for usage consumed during the attack; co-founder Dax Raad said the leak was limited to the Console platform and that the open-source app and command-line tool were unaffected. The company has asked affected users to revoke and replace their keys, and the incident is still being handled.