OpenCode breach exposes user API keys in distillation attack
A cyber attack on the open-source coding harness OpenCode exposed the full database of user API keys, generating significant costs for affected users. The incident has intensified debate over centralized safety models versus decentralized cyber defense capabilities.
OpenCode, an open-source coding harness, suffered a major cyber attack on Friday night that exposed its entire database of user API keys. The incident, described as a large-scale distillation attack, impacted 1.4% of console users and resulted in massive bills as hackers used stolen credentials to generate tokens for synthetic training data. OpenCode founder Dax Rad stated that the attack involved agents running continuously, a tactic similar to a previous incident involving Hugging Face. Major AI providers, including OpenAI, Anthropic, and Google, assisted in remediation efforts. OpenAI confirmed that damage mitigation was concluded on Sunday. Dean Ball of OpenAI noted that the lack of access to the company's Daybreak cyber defense program was a "fairly modest hindrance" that was quickly resolved. The incident has raised concerns about the security of services that store API keys and the viability of open-source coding tools for enterprise compliance. David Sachs used the incident to advocate for decentralized, widely available cyber-capable models, arguing that centralized safety approaches are insufficient. Sachs contended that the only durable response to AI-powered cyber attacks is decentralized, AI-powered cyber defense, rather than specialized access granted by individual labs.