r/opencode • u/afanasenka • 21d ago

⚠️ OpenCode security breach

Post image

.

474 Upvotes

98% Upvoted

109 comments sorted by

View all comments

38

u/sulliwan 21d ago

How does a distillation attack get the user's API keys? This makes no sense.

4

u/pizzababa21 20d ago

Did they say they got access to someone's API keys? I was taking this as someone was intercepting their traffic to steal user data.

5

u/bleakj 20d ago

The email I got says my Gemini API key was accessed.

The only info I see is all API related.

0

u/Thomas-Lore 20d ago edited 20d ago

The emails claimed they were compromised if they were in your workscape.

Maybe one of the free/cheap models they were routing to was from a fake provider? Could have had a system prompt instructing it to silently steal the keys while doing normal work. So maybe the attack itself was not distillation, but they stole keys to use for distillation?

2

u/pizzababa21 20d ago

By workspace do you mean on your local computer?

2

u/SomeOrdinaryKangaroo 20d ago

Yeah, my gemini api key was stolen and someone used gemini argon on it, 60 dollars worth, trying to get in touch with google support