GoKawiilOpenCode breach exposes API keys of 1.4% of Console users in distillation attack
OpenCode, an open-source AI coding agent, disclosed that a security breach exposed stored API keys for 1.4% of its Console users who had linked external AI providers such as Anthropic, OpenAI and Google. The project maintainer said affected users were notified by email, and several reported unauthorized charges, including one case exceeding $1,700 overnight, along with suspended Google Cloud projects. Co-founder Dax Raad said the attack used AI agents against OpenCode's systems for at least 48 hours before being detected.