OpenCode Breach: Hackers Steal API Keys to Train Models, Developers Lose Thousands

OpenCode Security Breach Exposes API Keys

OpenCode, an open-source AI coding tool, suffered a security incident linked to a large-scale distillation attack that affected approximately 1.4% of its Console users. Attackers gained access to API keys stored in user workspaces for major providers including OpenAI, Anthropic (Claude), and Google Gemini. The breach was acknowledged by OpenCode via official email and public posts, with the company confirming collaboration with Anthropic, OpenAI, and Google to mitigate the fallout.

Financial Impact on Developers

Victims reported sudden, massive spikes in API usage that drained account balances overnight. One user saw $400 in unauthorized Anthropic charges; another lost over $1,700; a third faced a Google Cloud bill exceeding $1,000. The attacks triggered automatic recharges, compounding losses. Screenshots shared by developers showed vertical spikes in token consumption within hours.

Root Cause: Legacy System Not Fully Decommissioned

OpenCode revealed the vulnerability resided in an "old legacy system" that was slated for decommissioning but had not yet been shut down. Hackers exploited this system to extract stored third-party API keys. The company urged immediate action: revoke and replace all potentially exposed keys at the respective provider consoles, review recent usage and billing, and update any applications dependent on the compromised keys.

Attackers' Motive: Free High-Quality Training Data

Analysis suggests the hackers were not reselling keys or stealing chat logs. Instead, they used the stolen credentials to generate massive amounts of high-quality chain-of-thought (CoT) and code generation outputs from top-tier models — data that would cost millions of dollars to produce legitimately. This "distributed free-riding" approach bypasses provider terms of service that prohibit using model outputs for training, and evades detection by spreading requests across thousands of legitimate developer accounts.

Industry Reaction and Precedent

AI observer TestingCatalog warned this sets a dangerous precedent, making reliance on smaller third-party AI aggregators significantly riskier. Anthropic's Lydia Hallie confirmed all suspected leaked Claude API keys were forcibly revoked. Notably, OpenCode co-founder Dax Raad disclosed his own personal account was also under attack, underscoring the breadth of the compromise.

Remediation Steps for Affected Users

Immediately revoke and regenerate API keys at the official consoles of OpenAI, Anthropic, Google Cloud, and any other providers used.

Changing login passwords or deleting keys within OpenCode does not invalidate already-leaked credentials; revocation must happen at the source.

Audit recent API usage and billing statements; preserve logs of anomalous calls, timestamps, and communications for potential disputes with providers.

Update all applications and services that depend on the old keys.

Key Lesson

In the AI era, API keys function as a developer's second identity. Entrusting them to convenient third-party consoles carries significant risk — attackers will not hesitate to exploit them for costly model training, leaving the key holder to foot the bill.

Code example

新智元报道
来源丨
转载自 新智元（AI_era）
编辑丨
桃子