OpenCode says a breach may have exposed some users' AI provider keys
OpenCode said unauthorized access to a legacy system may have exposed keys stored in Console workspaces, affecting 1.4% of Console users; it notified affected users and is working with OpenAI, Anthropic and Google on what it calls a distillation attack. Notebookcheck reported users' accounts of unexpected provider charges.
ThereforeAffected developers must replace linked keys and inspect provider usage to prevent further unauthorized bills.
Notebookcheck's account · x.com — OpenCode statement coverage