OpenCode Console Breach Exposes API Keys, Fuels AI Distillation Attack
Attackers compromised OpenCode Console, an online platform for the open-source AI coding agent, stealing API keys belonging to approximately 1.4% of users and generating unauthorised charges across OpenAI, Anthropic, and Google AI accounts. The stolen keys were allegedly leveraged for large-scale model distillation — extracting model outputs at volume — though some analysts dispute this framing. The incident also exposed a critical defensive gap: AI safety filters blocked the very models defenders needed to analyse malicious code, underscoring the operational tension between content moderation and security response.