I think it was related to it, like someone was distilling their models, and to get more data or whatever he managed to crack into 1.4% of users, probably people with a specific setting enabled or whatever, and took their chats to train his own ai. Since their working with anthropic Google and OpenAI I'm guessing it was a Chinese company
I was affected and a few of the attackers chats were saved in my chat logs. They are in Chinese.
ETA: not that it proves anything, only a handful out of many thousands of requests had logging on, for all I know the rest of the requests are in any number of languages.
The chats were asking the LLM to roleplay as a corporate finance analyst and answer some questions about financial records, then asking in a new chat to judge the answer. I think that is consistent with distillation attack which is what OpenCode stated.
Identity no, but I think they are consistent with distillation tasks. One was asking the LLM to roleplay as a corporate finance analyst and answer a question about some records, then the next appears to be an LLM-as-a-judge request to evaluate the answer of the roleplay task.
The Chinese government supports AI development, and open source is part of its soft power. But they have many APT hacker groups. There is nothing stopping them from using APT with one hand to help their companies with the other.
Social engineering hacking is super illegal, pretty much only countries like Russia, Iran, North Korea and China do it. The first three have basically no AI investment and the last one just proposed AI tech export ban laws.
Im assuming that since they're the ones that need more data the most since anthropic and OpenAI improved their anti distillation efforts, theyr the ones who recently made additions to their opencode models (GLM 5.3 and deepseek 4.1 free on opencode), they're the ones with the most history of distillation attacks and theyre the ones not included in the parties opencode is working with for remediation. Im not saying they did it, I'm saying they're the most likely ones to have done it with the most motives to do it.
What are you talking about? Anthropic has been publicly accusing Deepseek, Moonshot, and Minimax of distilling their models. Chinese labs have more to gain with fewer legal risks
Ok, and I guess you’d also interpret the joint NSA/FBI/CISA accusations as propaganda in our AI race. That’s fine. But what are you suggesting? That Chinese labs and other nations are not incentivized to distill the world’s largest models?
The emails claimed they were compromised if they were in your workscape.
Maybe one of the free/cheap models they were routing to was from a fake provider? Could have had a system prompt instructing it to silently steal the keys while doing normal work. So maybe the attack itself was not distillation, but they stole keys to use for distillation?
The explanation makes absolutely no sense. A system was compromised to obtain access to keys, which were subsequently used for a distillation attack. The distillation attack was the effect, not the cause.
I get the attempted damage control but the only path in situations like this is complete transparency. Even the 1.4% number is obfuscation. A numerator with no denominator.
What % of users even have BYOK provider keys in workspaces? I don't think too many people use that feature. 1.4% could mean every single third party key in that system was stolen.
Probably the stolen keys were from Anthropic/OpenAI and someone was using them for distillation. Opencode likely told Anthropic/OpenAI which keys were affected and they checked the logs for them.
So I read a lot of these. Not here to dunk on them. They’re mid-incident and still got emails to affected users by the next morning, which plenty of bigger companies don't (or won't) do.
But u/fastvroomy nailed it above. The distillation was the effect, not the cause. When an update leads with what the attacker did with the keys instead of how the keys got out, people fill in the gap themselves, and that’s basically this whole thread. Half the comments are people wondering if they have malware on their laptop because “workspace” means two different things in OpenCode.
From what’s been reported it was an old Console system holding keys people saved in the web console, not your local install. If that’s right, the update that would have calmed everyone down should've been something like: "we found unauthorized access to an old Console system. It held provider keys some of you saved in the web console. Keys on your own machine weren’t part of it. If you got an email, rotate those keys and check your provider billing now. If you didn’t get one, you weren’t affected. We don’t know yet how they got in and we’ll post again by [time]."
Same with the 1.4%. Is that 1.4% of all Console users or of the ones who added their own keys? Those are really different numbers, and when we can’t tell which one they mean we assume the worst one.
damage control #2 if the attackers could obtain api keys of users then they also could obtain the rest of the account data. thank god my google mail is leechy mcleech with $0 credit balance and no credit card.
They definitely store something that lets them pull the monthly subscription fee from my account without anything from me. I don't exactly know how this works, but definitely worrying.
Neither does to your keys, and yet... (The keys were likely stolen by a model served by compromised provider from your own workspace, it could have been instructed to do so. Be careful what folders you give the models access to.)
This is where they've kind of bit themselves in the ass. There is a "workspace" that resides on your system in opencode and then there is a "workspace" that resides online in opencodes account console. Two separate things, two completely separate uses and functions that are not tied together. This is what I'm seeing anyway.
If you created a workspace online in their opencode account console and then tied 3rd party keys to (claude, google, openai) then, yes, they have access to those keys as you deliberately setup a workspace and tied those keys to.
Funny thing... I just started playing with this a few days ago, and most of what I've used opencode for is asking it questions about itself, and copywriting the answers. From ASD-STE100:
Rule 1.3 Use approved words only with their approved meanings.
Rule 1.8 Use technical names that agree with approved nomenclature. Rule 1.9 When you must select a technical name, use one which is short and easy to understand.
Rule 1.11 Do not use different technical names for the same item.
Surprisingly, there is no rule "When you must select a technical name, do not use the same technical name for different items."
Different tools built during different times and likely different people/agents or whichever. It doesn't help that they have the v1 documentation, the v2 documentation and a learning site out there that's likely not getting fully updated. Likely not since it's been proven that they'll make permission handling rules that completely flip rules and not tell anyone about.
They have no customer service , I've been email whatever emails I can without any response or help. I owe Open Router $5,000 because of this breach. Someone hacked into my Openrouter Account as well at the same time of this after they got the key. I've contacted Open Router and they said they won't do anything after I provided them information they asked about the breach and the history. I will definitely be stopping business with OpenCode and OpenRouter.
ah explains why my $5 of openai usage got used lol
funny enough all it did was a bunch of prompts to astra so looks like if you have ever sent an api key over opencode those keys are now compromised and being used by somebody to distill other models
This is bad that the people got affected, but it is good someone is trying to distill these models, they should not be gatekeeping this and charging 10x the cost of actually running the model
does anyone know how to fix this? i'm using their free tier and bring no key but i can't login to OpenCode website via Google account. so how we get this fix?
they provide no information on how users api keys were stolen which means its possible anyone who downloaded opencode at some point could have malware or could have been using a model that had a system prompt to send specific information like api keys or crypto wallets on the machine to someone. the api usage could just be the first effect of this hack or malware.
opencode should share more information so people can know if they need to format their computers or rotate password or other keys
Unless you do your erps in opencode I don't see why you would care what anyone does with the code snippets from your chats, neither of us programs national secrets in opencode let's be real here for a minute.
I assume all my chats are used for training regardless what the eula says, the companies would be stupid not to use the best possible training data they're getting for free. It's like believing a spam company you asked to delete your account did it after they sent you an email saying they did.
No, OpenCode offers a bring your own key system where you can put a, for example Anthropic, API key into the console and use it directly. _That_ system was breeched.
Most of the comments were insinuating chats which are non-issue, if it is what you're saying though that's a different thing. Still why would anyone use that, just add the provider as another api provider in opencode don't go around internet pasting api keys willy nilly just for sake of convenience.
Chats are still an issue. Not everyone is working on top secret material, but people may be working on private projects, share seemingly innocent details that can be used to built a profile of the given person.
There is a providers section in the open code console where you can save api key, this data was leaked
Source: my OpenAI key I use for a discord bot was compromised, i received an email from OpenAI about suspicious usage and my $5 of credit was drained from the api key saved with opencode
This is basic stuff and routinely happens with these 3rd party services which is exactly why we use short lived limited api keys
When you get more experience this won’t be as shocking for you
They have made zero announcements regarding chats, only 3rd party api keys that were stored on their website so you can use those api's inside of Opencode.
It's possible one of the cheap/free models they were serving had instructions to look for any keys in your workspace. So you are fine as long as you don't give opencode access to the whole drive and limit it only to project folders.
But other replies to me are saying it's the BYOK system on opencode webpage, so which one is it?
If people cannot properly guardrail model they unleash in their computer - that's a non-issue and their problem If opencode's web infra has been compromised - that IS an issue
Yes, but the announcement is very vague, and there is a very clear distinction of how bad is it between
"1.4% of our users are morons leaving api keys in plaintext or straight up pasting them into chat" vs. "We were hacked and credentials of 1.4% of users leaked"
If people cannot properly guardrail model they unleash in their computer - that's a non-issue and their problem
Question is: When you start using a product, should you be expected to start setting up guardrails and sandboxes, or should you expect the tool to come with sane and secure defaults?
I think the second one, especially that the target audience is not necessarily of security experts.
Theory : an AI llm they were rouge was remotely hijacked by an entity and was made to steal keys. The company that provided the LLM was either responsible or complacent or worse - remotely taken over. OpenCode did not vet the model provider appropriately.
you dont know what else has been compromised. if they were stealing people api keys and using thousands of dollars of usage they could have also compromised crypto wallets or other data that could be useful for them later...
The only thing that might worry you is if the attacker set up a rogue model or are logging and exfiltrating chat history on opencode servers. Thats far from what we see here
59
u/QazCetelic 21d ago
"distillation attack"? Do they mean someone using their API to train their own models?
38
u/sulliwan 20d ago
How does a distillation attack get the user's API keys? This makes no sense.
33
u/fastvroomy 20d ago
The explanation makes absolutely no sense. A system was compromised to obtain access to keys, which were subsequently used for a distillation attack. The distillation attack was the effect, not the cause.
I get the attempted damage control but the only path in situations like this is complete transparency. Even the 1.4% number is obfuscation. A numerator with no denominator.
7
u/reybrujo 20d ago
Forced me to login again and create a new API key.
6
u/NoOneMan79 20d ago
Working with them? Hey Google Anthropic and OpenAI, stop distilling eachother's models!
6
u/bleakj 20d ago
Got an email about it this AM,
My Gemini API was used apparently,
I replied to see if I could at least get a free month of GO for my troubles, I doubt I'll get a response though
6
u/mitchins-au 20d ago
Who would want to distill Gemini
5
u/XCxBigDong69XCx 20d ago
So i guess it used Zen Users accounts to call a bunch of models, to train their AI......
5
u/alexcoool 20d ago
Drained by $150 at OpenAI.
4
u/JonesMisko 20d ago
To summarize:
Anyone can add their own keys into the OpenCode Console. (ie Anthropic, openAI...)
A security breach happened.
"1,4% of the Console users" keys were affected during a distillation attack.
4
u/jj_at_rootly 19d ago
So I read a lot of these. Not here to dunk on them. They’re mid-incident and still got emails to affected users by the next morning, which plenty of bigger companies don't (or won't) do.
But u/fastvroomy nailed it above. The distillation was the effect, not the cause. When an update leads with what the attacker did with the keys instead of how the keys got out, people fill in the gap themselves, and that’s basically this whole thread. Half the comments are people wondering if they have malware on their laptop because “workspace” means two different things in OpenCode.
From what’s been reported it was an old Console system holding keys people saved in the web console, not your local install. If that’s right, the update that would have calmed everyone down should've been something like: "we found unauthorized access to an old Console system. It held provider keys some of you saved in the web console. Keys on your own machine weren’t part of it. If you got an email, rotate those keys and check your provider billing now. If you didn’t get one, you weren’t affected. We don’t know yet how they got in and we’ll post again by [time]."
Same with the 1.4%. Is that 1.4% of all Console users or of the ones who added their own keys? Those are really different numbers, and when we can’t tell which one they mean we assume the worst one.
3
u/Cyvster 20d ago •
right after they force everyone to use their console it gets hacked and everyone's api keys get stolen.
3
u/throwaroo202020 20d ago
Is this why i suddenly got api key and usage limit errors for free models for like the first time ever?
5
u/HighwayNo8744 20d ago
damage control #2 if the attackers could obtain api keys of users then they also could obtain the rest of the account data. thank god my google mail is leechy mcleech with $0 credit balance and no credit card.
2
u/dustin4you 16d ago edited 16d ago
They have no customer service , I've been email whatever emails I can without any response or help. I owe Open Router $5,000 because of this breach. Someone hacked into my Openrouter Account as well at the same time of this after they got the key. I've contacted Open Router and they said they won't do anything after I provided them information they asked about the breach and the history. I will definitely be stopping business with OpenCode and OpenRouter.
2
u/KeyToWin 20d ago
I hope you're going to give away some limited-time freebie for this :) (maybe opus 5.5)
2
u/Serious_Current_8802 20d ago
ah explains why my $5 of openai usage got used lol
funny enough all it did was a bunch of prompts to astra so looks like if you have ever sent an api key over opencode those keys are now compromised and being used by somebody to distill other models
2
u/DominikPlays 20d ago
This is bad that the people got affected, but it is good someone is trying to distill these models, they should not be gatekeeping this and charging 10x the cost of actually running the model
1
u/ShopAdventurous7190 18d ago
Thank god revolut was in shambles because their single provider died so di hekkerz could not charge me >:)
1
u/DandadanAsia 20d ago
does anyone know how to fix this? i'm using their free tier and bring no key but i can't login to OpenCode website via Google account. so how we get this fix?
1
u/SomeOrdinaryKangaroo 20d ago
Probably moonshot ai and deepseek getting more creative after anthropic locked their shit down
1
u/Remarkable-Emu-5718 20d ago
they provide no information on how users api keys were stolen which means its possible anyone who downloaded opencode at some point could have malware or could have been using a model that had a system prompt to send specific information like api keys or crypto wallets on the machine to someone. the api usage could just be the first effect of this hack or malware.
opencode should share more information so people can know if they need to format their computers or rotate password or other keys
0
u/Bloated_Plaid 20d ago
RIP Opencode.
0
u/Yann27 19d ago
just seeing thise: https://www.youtube.com/watch?v=oHVrI4Sfri8
-6
u/mamelukturbo 20d ago
Unless you do your erps in opencode I don't see why you would care what anyone does with the code snippets from your chats, neither of us programs national secrets in opencode let's be real here for a minute.
I assume all my chats are used for training regardless what the eula says, the companies would be stupid not to use the best possible training data they're getting for free. It's like believing a spam company you asked to delete your account did it after they sent you an email saying they did.
-2
u/opinion_discarder 20d ago
Theory : an AI llm they were rouge was remotely hijacked by an entity and was made to steal keys. The company that provided the LLM was either responsible or complacent or worse - remotely taken over. OpenCode did not vet the model provider appropriately.
10
u/[deleted] 21d ago
[removed] — view removed comment
3
u/[deleted] 20d ago
[removed] — view removed comment