Open-source AI programming tool OpenCode was hacked, affecting approximately 1.4% of users

According to NetEase's report on "DeepTech," the open-source AI programming tool OpenCode has officially confirmed it was breached, affecting approximately 1.4% of OpenCode Console users, with some API keys for models stored on the platform potentially leaked. Multiple developers reported unusual charges on accounts used to call models from OpenAI, Anthropic, and others, with some claiming losses of hundreds of dollars and others stating amounts exceeding $1,700. The officials stated that the incident is related to a large-scale distillation attack and are currently working with OpenAI, Anthropic, and Google to address the issue.

OpenCode was developed by members of the Anomaly team, with one of the main creators being Dax Raad. The team has previously worked on projects like SST and OpenNext. In addition to local programs, its cloud service Console can centralize API keys from providers like OpenAI, Anthropic, and Google in a workspace and call them on behalf of users; the incident occurred on this cloud service. A notification email stated that the attacker gained unauthorized access to a set of decommissioned old systems, and some third-party model API keys in the Console workspaces may have been exposed. Developer Colin Parsons reported unusual charges of about $281 on his OpenAI account and about $168 on his Anthropic account, while Preston Zeller reported losses of around $1,700. Other users reported unusual charges of about $400 on Anthropic and account restrictions triggered by unusual usage on Google services.

OpenCode has notified affected users to revoke and replace their keys and check recent call records. Lydia Hallie, a member of the Anthropic Claude Code team, stated that Anthropic has collaborated with OpenCode and revoked the Claude API keys believed to be affected. Tibo, a member of the OpenAI team, stated that they are working with OpenCode to help affected API users restore access and refund the amounts that were unusually consumed during the attack. Dax Raad clarified that the affected service is OpenCode Console, not the locally running OpenCode, and that keys configured directly in the local tool will not be sent to OpenCode servers. On October 18, he stated on social media that the attacker had been continuously attempting to breach the system for the past 48 hours, and the team is strengthening defenses.