OpenCode Console breach exposes API keys of 1.4% of users

Attackers broke into an older OpenCode Console system, exposing API keys for 1.4% of users of the AI coding platform. Anthropic and Google blocked the compromised keys, and OpenAI said it would refund API credits used in the attack. OpenCode linked the incident to a large-scale distillation attack without explaining how it worked.

• 1.4% of OpenCode Console users affected; all were emailed
• Some developers saw overnight charges above $1,000
• Anthropic and Google blocked exposed keys; OpenAI to refund credits
• Open source app and CLI were not affected, keys never reach OpenCode