Leak of OpenAI, Anthropic, and Google API Keys from OpenCode

Developers of the open-source AI agent OpenCode reported a leak of API keys from major providers. Attackers gained access to OpenAI, Anthropic, and Google keys through vulnerabilities in the project's cloud console.

The attack affected approximately 1.4% of users. Keys from the CLI and desktop application were not compromised, as they are stored locally in SQLite and not transmitted to servers.

Consequences of the incident include financial losses and resource blocking

• Some users experienced unauthorized charges, with damages reaching up to $1,700
• Google Cloud suspended projects belonging to victims due to signs of resource abuse

Project co-founder Dax Raad stated that attackers used AI agents to breach infrastructure. The process took at least 48 hours, with security filters on models hindering the attack until access was gained to a version with relaxed constraints.

The company links the incident to a large-scale attack aimed at distilling AI models. Specific details regarding which exact models were stolen are not disclosed.

Recommendations for data protection

• Immediately revoke provider keys and issue new ones
• Simply deleting a key from the console is useless, as the stolen copy continues to work

Affected users have been promised potential compensation for damages. For additional information on project security, please refer to official sources.