OpenCode 云服务遭入侵，1.4% 用户 API 密钥泄露
AI 总结
OpenCode 于当地时间 10 月 17 日确认，一套正在停用流程中的旧系统遭到未授权访问，波及约 1.4% 的 OpenCode Console 用户，工作区中保存的 OpenAI、Anthropic、Google 等第三方模型 API 密钥可能泄露；公司已通过邮件通知受影响用户，并表示正与三家模型厂商合作采取补救措施。多名开发者报告异常扣费，有人称 Anthropic 账户被刷走 400 美元，也有人称单日账单超过 1700 美元；据报道 Anthropic 已强制注销疑似泄露的 Claude 密钥，OpenAI 方面则表示将全额退还攻击期间异常扣除的额度。OpenCode 将事件与一场“大规模模型蒸馏攻击”相关联，但开发者与研究者在技术社区质疑这一表述并未说明凭证是如何被获取的，目前完整调查报告尚未公布。
深度见解
事件说明，把 API 密钥托管给第三方云端控制台后，凭证一旦外泄，攻击者可绕过该平台直接向模型厂商消耗额度；报道建议受影响者到签发密钥的厂商处吊销旧密钥，仅修改登录密码或在本地删除配置并不能让已流出的凭证失效。
Post
Post
🚨 AI News | TestingCatalog on X: "OpenCode published an official statement regarding a recent distillation attack. > Earlier today, OpenAI, Anthropic and Google balances of some OpenCode users got drained. > Reportedly, only 1.4% of users were affected and these users were notified via an email. This is a serious precedent because if this distillation vector is the simplest to execute, that means that major AI labs are now much more protected than they were earlier. This also means that using smaller providers is now less safe. Additionally, tokens from leading AI labs now have a higher value since they are harder to get for distillation. A wild AI west 👀"
- 🚨 AI News | TestingCatalog @testingcatalog OpenCode published an official statement regarding a recent distillation attack. > Earlier today, OpenAI, Anthropic and Google balances of some OpenCode users got drained. > Reportedly, only 1.4% of users were affected and these users were notified via an email. This is a serious precedent because if this distillation vector is the simplest to execute, that means that major AI labs are now much more protected than they were earlier. This also means that using smaller providers is now less safe. Additionally, tokens from leading AI labs now have a higher value since they are harder to get for distillation. A wild AI west 👀 OpenCode @opencode Oct 17 We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers Show more 7:15 PM · Oct 17, 2026·43.2K Views 58 19 462 69
- Mads @Laz01L 23h stuff like this is why im happy im on subscriptions and not api keys 4 557
- Arbaz @arb5z Oct 17 breach last night, email this morning. so the keys just kept burning all night? 3 832
#OpenCode#OpenCode Console#Anomaly Innovations#OpenAI#Anthropic#Google#Dax Raad#Lydia Hallie