OpenCode has confirmed a security incident in which credentials were stolen and used to run up unauthorised charges. It attributes the breach to a large-scale distillation attack and says it affected 1.4 per cent of the users of its console. The number of accounts has not been given.
The first signs came from users, who reported waking up to unexpectedly large bills after their API keys were taken. One user described the company as hacked, a label that comes from an individual's social media post and not from the company. OpenCode described a security breach the previous night. On 17 October it emailed the affected accounts, and users have been urged to revoke their API keys and change their passwords.
The company says it is working with three major AI providers on remediation, which is continuing, and that it cannot share more while that work goes on.
Several basics are unknown: how the credentials were obtained, who carried out the attack and why, the total value of the charges, whether anything beyond keys and credentials was accessed, and which providers' keys were misused.
