OpenCode breach may expose AI API keys of about 1.4% of Console users
OpenCode, an open-source AI coding-agent tool, suffered a security incident on the evening of October 16, according to iThome, which cites multiple media reports. Attackers carried out a large-scale distillation attack after breaching a system slated for retirement, potentially obtaining third-party AI service API keys stored in some users' OpenCode Console workspaces and affecting about 1.4% of Console users, the report said. OpenCode emailed affected users and is working with OpenAI, Anthropic and Google; Anthropic and Google blocked suspected leaked keys, while OpenAI said it is helping users recover and refunding charges incurred during the attack. Users have reported unauthorized API requests, unexpected charges and projects suspended after Google detected anomalous activity.
The reported fallout—unauthorized API requests, unexpected charges and suspended projects—highlights the operational risk of storing third-party AI keys in coding-agent workspaces.
From the digest “【資安日報】10月20日，AI程式碼代理平臺OpenCode資料外洩，聯繫OpenAI、Ant…”
AI程式碼代理平臺OpenCode資料外洩，尋求OpenAI、Anthropic、Google合作處理
開源AI程式碼代理工具OpenCode於10月16日晚間發生資安事故，攻擊者發動大規模蒸餾攻擊，可能取得部分使用者儲存在OpenCode Console工作區中的第三方AI服務API金鑰，影響約1.4%的Console使用者，OpenCode已透過電子郵件進行通知，並與OpenAI、Anthropic、Google合作因應此事。綜合多家媒體的報導，攻擊者駭入OpenCode即將淘汰的系統而得逞 。事件曝光後，已有使用者在網路社群回報帳戶出現非本人發起的API請求與異常費用，也有使用者表示，他們的專案因Google偵測到異常活動而遭到停用。Anthropic和Google已封鎖疑似洩露的API金鑰；OpenAI表示正與OpenCode合作，協助用戶恢復運作，並退還攻擊中產生的扣款。詳全文