OpenCode hack exposes API keys amid AI distillation attacks
OpenCode, an open-source AI coding project, disclosed a security breach that exposed API keys belonging to a subset of its users. The keys were connected to external AI service providers, meaning the exposure extended beyond OpenCode itself.
Why this matters: API keys are essentially passwords to paid services and the data inside them. If yours was exposed, someone else can use your account, run up charges, or access whatever those services can reach. This breach sits inside a broader pattern called AI distillation attacks, where attackers target AI tooling to get at the infrastructure underneath. Open-source AI projects often move fast and attract developers who plug in real credentials early. That combination makes them a soft target. If you use OpenCode with external provider keys, rotate them now and check your usage logs.
Who should care: Cybersecurity · Privacy officers · Administrators · General readers · AI governance · Policy
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.