I don't know if this is the best place to post this, there's been reports that OpenCode experienced a serious security bridge yesterday which resulted in data loss that impacted users negatively. This was confirmed by their X account below
We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate
https://x.com/opencode/status/2111519637049319818Users are already reporting loses as their Open AI and Anthropic API keys were consumed and accounts suspended. They had breach data and their clients API keys were stolen which was used to exhaust their subscriptions with external providers
Source: X
The incident is still going on and those that use OpenCode are advised to do the following:
- Check their email for notifications
- Revoke their keys(since it might be among those stolen)
- generate new keys to be safer
Whether you got the email notification or not, generate new API keys to be on the safer side
