OpenCode users found out their AI keys were exposed when the charges appeared on somebody else's model
2026-10-19AI
A legacy console the company was already decommissioning held provider keys for OpenAI and Anthropic. OpenCode calls it a distillation attack. It has not published how anyone got in, how long they were there, or how many keys were taken.