OpenCode discloses distillation attack that hit 1.4% of Console users

OpenCode, the open-source AI coding platform, has disclosed that attackers exploited vulnerabilities in a legacy system to access API keys stored in user workspaces, affecting about 1.4% of its Console users who had linked external AI provider accounts. The keys, connected to models from Anthropic, OpenAI, and Google, were used to run repeated queries against high-end models at affected users' expense, and OpenCode is advising users to rotate or revoke their keys, Crypto Briefing reports.