OpenCode Breach Exposes AI API Keys, Leading to Unauthorized Charges and Suspended Cloud Projects

OpenCode experienced a breach that exposed stored API keys belonging to 1.4% of its Console users who had linked outside providers such as Google, OpenAI, and Anthropic. The attackers reportedly used AI agents in a 'distillation attack' for at least 48 hours, resulting in unauthorized charges of up to $1,700 and suspended Google Cloud projects for some users.