Huo Xing Cai Jing reports, according to NetEase’s DeepTech, the open-source AI programming tool OpenCode has officially confirmed a breach, affecting approximately 1.4% of OpenCode Console users, with some model API keys stored on the platform potentially compromised. Several developers reported unusual charges on their accounts used to invoke models from OpenAI, Anthropic, and others, with losses ranging from hundreds to over $1,700. The official statement attributes the incident to a large-scale distillation attack and states that OpenCode is collaborating with OpenAI, Anthropic, and Google to address it. OpenCode was developed by members of the Anomaly team, with Dax Raad among its primary creators; the team previously worked on projects such as SST and OpenNext. In addition to its local application, its cloud-based Console service allows users to centrally store and automatically invoke API keys from providers such as OpenAI, Anthropic, and Google—this cloud service was the target of the breach. The notification email states that attackers gained unauthorized access to an outdated system that was in the process of being decommissioned, potentially exposing third-party model API keys in some Console workspaces. Developer Colin Parsons reported unusual charges of approximately $281 on his OpenAI account and $168 on his Anthropic account; Preston Zeller reported losses of about $1,700. Other users reported approximately $400 in unusual charges on Anthropic accounts and account restrictions triggered by abnormal usage of Google services. OpenCode has notified affected users to revoke and rotate their API keys and review recent usage logs. Lydia Hallie, a member of Anthropic’s Claude Code team, stated that Anthropic has collaborated with OpenCode to revoke Claude API keys believed to be compromised. Tibo, a member of the OpenAI team, said they are working with OpenCode to help affected API users restore access and refund amounts improperly consumed during the attack. Dax Raad clarified that only the OpenCode Console was affected—not the locally run version of OpenCode—and API keys configured directly within the local tool were never transmitted to OpenCode servers. On October 18, he stated on social media that attackers had been persistently attempting to breach the system over the past 48 hours and that the team is strengthening its defenses.
OpenCode AI Programming Tool Suffers Breach; 1.4% of Users Affected
MarsBitShare
Summary
The OpenCode AI programming tool confirmed a security breach affecting 1.4% of its OpenCode Console users. Some users reported unauthorized charges on their OpenAI and Anthropic accounts, with losses up to $1,700. The incident was caused by a large-scale distillation attack. OpenCode is collaborating with OpenAI, Anthropic, and Google to resolve the issue. Affected users have been instructed to revoke and regenerate their API keys and review recent activity. OpenAI and Anthropic are assisting in restoring access and refunding unauthorized charges.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.