OpenCode breach may have exposed API keys for AI services
What's the story
OpenCode, a platform that integrates models from various AI providers, has confirmed a security breach. The company revealed that an unauthorized party accessed a legacy system it was decommissioning. This incident may have exposed third-party API keys saved in user workspaces, including those for popular services like OpenAI and Anthropic.
Impact assessment
Unauthorized charges and access issues for users
The breach has already resulted in unauthorized charges for some users.
One user reported a $400 charge on their Anthropic account, while another said Google usage charges had reached around €200. The latter's project was even suspended for excessive abuse.
Several users also reported problems accessing OpenCode services after their API keys expired or failed to work during sign-in attempts via Google or GitHub.
Attack details
OpenCode collaborates with AI providers to address breach fallout
OpenCode has confirmed that 1.4% of its Console users were affected by this security breach.
The company linked the incident to a large-scale distillation attack, where an AI model's responses are collected to train another model.
The incident has prompted OpenCode to work with Anthropic, OpenAI, and Google in its mitigation efforts.
User guidance
User precautions and cybersecurity concerns
In light of the breach, OpenCode has advised affected users to revoke and replace their provider keys.
The company also urged them to update applications using these keys and review recent usage for any unexpected activity.
The incident underscores the importance of cybersecurity in platforms dealing with sensitive API data from multiple AI providers.