AI Weekly Malaysia

OpenCode said attackers breached an older system overnight and affected 1.4% of OpenCode Console users, where some users store API keys for AI providers. Developers reported spend alerts and unauthorized charges in the hundreds of dollars, with a few above $1,000; Anthropic and Google blocked exposed keys, OpenAI refunded API credits, and OpenCode says refunds are underway. The company called it a "large-scale distillation attack," while skeptics said the distillation use is unproven.

Why: If you use OpenCode Console—or any AI coding agent that stores provider API keys for you—rotate those keys now and set hard spend limits with OpenAI, Anthropic, and Google. The reported charges reached hundreds to over $1,000 per account before providers and OpenCode responded, so storing long-lived provider keys in a third-party console is a concrete risk to decide on, not a hypothetical one.

The Hacker News reports that a breach of the OpenCode console may have exposed API keys for OpenAI, Anthropic, and Google. The item is currently framed as a possibility ("may have exposed"), and the fetched article text contains only the headline and site chrome — no figures on how many keys, the time window, the mechanism, or any vendor or OpenCode response. Treat the specific scope as unconfirmed until the full write-up or an official statement is available.

Why: If you have pasted an OpenAI, Anthropic, or Google API key into a third-party coding console or agent tool — OpenCode included — the concrete move is to rotate those three keys now and check each provider's usage and billing dashboard for spend you don't recognise, rather than waiting for confirmation. Going forward, issue separate keys per project with hard spend caps so one leaked console key can't drain a shared account. The text gives no timeline or affected-user list, so you cannot yet tell from it whether you were in scope; rotation is the cheap hedge.