A security breach at OpenCode, an open-source AI coding tool that lets developers connect their own API keys to multiple AI providers, exposed credentials stored by a subset of its Console users. Attackers used the stolen OpenAI, Anthropic, and Google API keys to run unauthorized, costly AI queries, racking up unexpected charges on affected accounts. OpenCode said roughly 1.4% of Console users were affected and urged them to revoke and replace their provider keys. The company linked the incident to a large-scale AI model distillation attack.