OpenCode legacy system leaks API keys, 1.4% of users' balances drained

Open-source AI coding tool OpenCode admits that a legacy system slated for decommissioning was attacked, and about 1.4% of Console users' OpenAI, Anthropic, and Gemini API keys stored in workspaces were leaked. OpenCode says this is a security vulnerability related to large-scale distillation attacks. Hackers used the stolen credits to generate CoT and code data from top-tier models to train their own models. One user's Anthropic account was charged $400, and another bill was charged over $1,700. Anthropic's Lydia Hallie said all suspected leaked Claude API keys have been forcibly revoked. OpenCode co-founder Dax Raad said his personal account was also under attack. OpenCode recommends users revoke and replace keys in each provider's console and check recent bills.