OpenCode hack exposes API keys amid AI distillation attacks
BLUF
OpenCode users who stored or used third-party API keys should rotate them now because exposed keys can be abused for unauthorized AI usage and data access.
NEWS
OpenCode notified affected users that API keys used with external providers were exposed in a security incident. The breach is being discussed alongside AI distillation attacks, where stolen credentials or model access may be exploited to extract capabilities from AI services.
Why I Care
Exposed API keys can let attackers run paid AI workloads, access sensitive prompts or outputs, and potentially abuse provider accounts. The risk is highest for developers and organizations that use OpenCode with cloud AI providers or store credentials in local or shared environments.
Next Steps
Affected users should immediately revoke and rotate exposed API keys, review provider usage logs for unauthorized activity, enable stronger authentication where available, update OpenCode to the latest secure version, and audit how keys are stored. Organizations should monitor billing and enforce secret-management practices for AI tooling.
Source: BleepingComputer ·