OpenCode Hacked: User credentials leaked

Scope and Nature of the Breach

• Breach involved a legacy, hosted “Console” system where users stored third‑party API keys (e.g., OpenAI, Anthropic).
• Only “bring your own key” credentials stored in this backend are confirmed affected; the main CLI/desktop coding agent is repeatedly claimed to be unaffected, but some commenters note the company’s messaging is confusing and incomplete.
• Several users report their OpenAI/Anthropic credits being suddenly exhausted, consistent with stolen-key abuse.
• The company’s framing references a “large-scale distillation attack,” but many point out there is no public evidence yet of what the stolen keys were actually used for.

---

User Impact and Mitigation

• Users are told to revoke and rotate their AI provider keys and review recent usage; some report providers or the platform auto‑revoking keys.
• There is concern that the company cannot easily reimburse losses since these are third‑party keys billed by other providers.
• Some clarify that users of other services (Zen, Go) or purely local setups may be unaffected, but there is lingering uncertainty, especially around any agents that might consume .env files.

---

Security Practices and Trust

• Multiple commenters describe this as part of a pattern: “vibecoding” / AI‑generated designs, weak security culture, prior regressions, and sending prompts to external services without clear disclosure.
• Others defend the project as open source, “private by default,” and say controversial features (e.g., free title generation via remote models) were short‑lived and later removed.
• The Console UX—encouraging users to paste provider keys with minimal ToS/privacy clarity—is heavily criticized.
• Some call for a detailed public postmortem, including an open dataset of attacker queries, and possibly external security audits.

---

Broader Discussion: API Keys and Distillation

• Debate over “distillation attack”: explanation that it can mean using a powerful model’s outputs (via stolen keys) to train cheaper models, but commenters stress this is speculative here.
• Discussion of best practices: use gateways (e.g., LiteLLM‑style or similar) rather than uploading raw keys to vendors; better key revocation mechanisms; concerns that universal “invalidate_api_key” endpoints could be abused for denial‑of‑service.

---

Community Dynamics

• Several note unusual flagging/downranking of critical comments and speculate about brigading or automated moderation.
• Many conclude their trust in the service is badly damaged and plan to switch tools; a minority still see good value in some paid offerings if security practices improve.