OpenCode Breach Exposes API Keys of 1.4% Users After Distillation Attack
astrange · x · 2026-10-18
OpenCode, the popular open-source AI coding harness, confirmed a security breach from a large-scale distillation attack affecting 1.4% of Console users — specifically those with external providers linked. All affected users were notified by email.
Reposting the news, @soupsranjan notes developers' API keys to frontier labs like OpenAI and Anthropic were apparently stored in cleartext and exposed, framing "AI token theft" as one of the fastest-growing fraud vectors: trust takes years to earn but seconds to lose, and AI companies that take security seriously win long-term.
The incident is ongoing; OpenCode says it is working with Anthropic, OpenAI, and Google on remediation.
More from coding & agent
- Author Laurence Moroney: write your ugly first draft yourself, then let an LLM edit it — lmoroney · 2026-10-18
- Open-weight TYGER speech decision model makes 80ms turn-taking calls for full-duplex voice agents — solyarisoftware · 2026-10-18
- Devs: Opus 5.5 on medium beats Opus on max — eyishazyer · 2026-10-18
- He Stopped Telling Claude Code to Stop Making Up Timestamps—and Made It Impossible with a PreToolUse Hook — Grimmoner · 2026-10-18
- Cursor Super + Claude Pro + OpenCode: can this stack survive heavy autonomous coding? — DarioAmodeiWasTaken · 2026-10-18
- Coding AI wars: model is faster and smarter but 'dogshit at actual engineering' — MarcJSchmidt · 2026-10-18