GoKawiilOpenCode breach exposes API keys of 1.4% of Console users in distillation attack
OpenCode, an open-source AI coding agent, disclosed that a security breach exposed stored API keys for 1.4% of its Console users who had linked external AI providers such as Anthropic, OpenAI and Google. The project maintainer said affected users were notified by email, and several reported unauthorized charges, including one case exceeding $1,700 overnight, along with suspended Google Cloud projects. Co-founder Dax Raad said the attack used AI agents against OpenCode's systems for at least 48 hours before being detected.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident highlights how distillation attacks, normally a legitimate technique for training smaller models cheaply, can be weaponized to siphon value from exposed credentials at scale. Raad's account that AI safety safeguards blocked the company's own investigation suggests a growing tension between automated defenses and incident response. The breach could prompt scrutiny of how open-source developer tools store and secure third-party API keys.
- 1.4% of OpenCode Console users had API keys exposed after linking external AI providers.
- Some affected users reported unauthorized charges over $1,700 and suspended Google Cloud projects.
- Co-founder Dax Raad said AI-driven attackers targeted OpenCode's systems for at least 48 hours before discovery.
Source: bleepingcomputer.com, 2026-10-19
Published there as: “OpenCode hack exposes API keys amid AI distillation attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.