OpenCode hack exposes API keys amid AI distillation attacks

The open-source AI coding project OpenCode has notified some users that stored API keys they used with external providers were exposed in a security breach. Multiple users reported that the incident led to unauthorized API charges and suspended projects in Google Cloud. According to the project maintainer, the breach affected 1.4% of OpenCode Console users, with some reporting more than $1,700 in unauthorized charges overnight.

Published 19-Oct-2026 22:22 UTC · First seen 19-Oct-2026 22:21 UTC

Sources

• BleepingComputer · 19-Oct-2026