OpenCode Breach Drains Users’ API Keys

OpenCode users are reporting unauthorized API charges after a security breach, @kimmonismus reported on October 17, including one report of $400 spent on an Anthropic account. OpenCode confirmed that at least 1.4% of its Console users were affected, and its customer email warned about third-party provider keys stored with the service.

@sudoingX quoted the incident as “a large scale distillation attack, 1.4% of console users hit.” He relayed that one user said his OpenAI and Anthropic keys, used only in OpenCode, ran up more than $400 overnight, and another replied with a $1,700 figure.

@MiaAI_lab posted an alert that OpenCode had been breached, said affected users should have received an email, and advised changing API keys. In a separate post she said her own OpenCode account had been drained of usage.

The episode is already changing how some builders work. @sudoingX said that after the breach he wants his API keys on his own machine. He is reverse-engineering a harness he likes in Rust, where “the whole thing is one binary, no venv or node_modules,” and plans to route most of his local tasks and API calls through it.