OpenCode has been hacked and clients API keys stolen

[Ashawowo(OS)]

I don't know if this is the best place to post this, there's been reports that OpenCode experienced a serious security bridge yesterday which resulted in data loss that impacted users negatively. This was confirmed by their X account below

We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users

We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked

The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate

https://x.com/opencode/status/2111519637049319818

Users are already reporting loses as their Open AI and  Anthropic API keys were consumed and accounts suspended. They had breach data  and their clients API keys were stolen which was used to exhaust their subscriptions with external providers

Source: X

The incident is still going on and those that use OpenCode are advised to do the following:

• Check their email for notifications
• Revoke their keys(since it might be among those stolen)
• generate new keys to be safer

Whether you got the email notification or not, generate new API keys to be on the safer side

[joniboini]

Are they related to crypto at all? As far as I can tell they're basically an AI agent for writing codes. As far as I can tell they're not directly related to any crypto project. Are there projects built with it getting exposed too, specifically related to crypto? Or crypto users use this for something that I'm not aware of?

Anyway, this incident feels very similar to how scammers abuse trading API on various exchanges in the past. I remember one of the biggest platform for algorithmic trading was a victim too. This case can affect more things if the number of users who use this to manage or interact with crypto projects is huge I guess. CMIIW.

[Emjay24]

Are they related to crypto at all? As far as I can tell they're basically an AI agent for writing codes. As far as I can tell they're not directly related to any crypto project. Are there projects built with it getting exposed too, specifically related to crypto? Or crypto users use this for something that I'm not aware of?

From the service they offer which is an AI powered agent for writing code, there may be possibilities that data leaked was beyond API keys to burn credits. If they've had access to the data for the AI assisted source codes already written by the developers of crypto projects using their service, then those codes may be reviewed by the hackers and identified vulnerability would be used to continue attacks on crypto platforms in later dates. We cannot fully ascertain the extent of data beached.

Sometimes I wonder how they got access to accurate API keys, does it mean OpenCode stored them in plain text?
Those API keys should be tied to specific accounts, which brings about the possibility that more data is out there in the hands of the bad guys.

[TryNinja]

1.4% of OpenCode Console users affected

https://x.com/opencode/status/2111519637049319818

I haven't been affected at all, and I use OpenCode for some stuff.

[Ashawowo(OS)]

1.4% of OpenCode Console users affected

https://x.com/opencode/status/2111519637049319818

I haven't been affected at all, and I use OpenCode for some stuff.

Great, happy for you. I hope you'll not wait to be affected in order to do this

Whether you got the email notification or not, generate new API keys to be on the safer side

Sometimes I wonder how they got access to accurate API keys, does it mean OpenCode stored them in plain text?

Here, I found this response to your inquiry

We read the code behind OpenCode's old Console. Short answer: yes, customers' AI provider keys were saved in plaintext. 🧵⤵️

You can read up

[348Judah]

How could they have been so careless with search access, when did know that it could be taken as a vulnerability to users on their platform, I don't want to believe this day are claiming that writing the API keys we are made on a paper, this should rather be an insider work, who else could get access to what they are storing if not those within the system, this is also giving a serious alarm towards those that are making use of various AI tools or API for one thing or the other to be more careful.

[Accardo]

I haven't been affected at all, and I use OpenCode for some stuff.

The attack affected users who linked external AI providers using console to share Api keys with team members. If you didn't receive any mail from Open code then you are fine, only affected users was mailed. I haven't used Opencode, was wondering shouldn't there be a dashboard that shows what the attackers did with the compromised keys?