OpenCode hit by distillation attack, user API keys may have leaked

OpenCode has disclosed that its platform suffered a large-scale "distillation attack", affecting 1.4% of OpenCode Console users. Only users linked to external service providers were impacted, and the company has notified them by email.

Emails shared by users show someone gained unauthorized access to an old OpenCode system that was being shut down. API keys stored in user workspaces may have leaked, letting others send requests under account holders' names and run up charges.

Several users reported unexpected costs. One user's Anthropic account was billed $400 without authorization, and another faced about 200 euros in Google service fees, with the project suspended for "excessive abuse".

OpenCode said the incident is still being handled and details remain limited, adding that it is working with Anthropic, OpenAI and Google on fixes. Some users said they received usage alerts from those providers before OpenCode's notice.