OpenCode hack exposes API keys amid AI distillation attacks

OpenCode, an open-source AI coding project, notified some users that their API keys for external providers were exposed due to a security breach. The breach specifically compromised API keys, which are sensitive credentials used to authenticate and authorize access to external services. No further technical details, such as the breach vector or scope, have been provided. There is no evidence of known exploits or active attacks leveraging this exposure at this time.

Exposure of API keys can lead to unauthorized access to external services linked to those keys, potentially resulting in data leakage, service misuse, or financial impact depending on the privileges of the keys. Since only a small number of users were affected and no active exploitation is reported, the immediate impact appears limited but could escalate if keys are abused.

No vendor advisory or patch information is available. Users notified of the breach should immediately revoke and regenerate their exposed API keys with the external providers to prevent unauthorized access. It is recommended to audit usage of the compromised keys and monitor for suspicious activity. Since this is an open-source project, users should also follow any updates or guidance from the OpenCode maintainers.