Home / Technology / AI Coder Breach: API Keys Exposed in Cyberattack
AI Coder Breach: API Keys Exposed in Cyberattack
20 Oct
Summary
- OpenCode reported a breach affecting 1.4% of its users.
- Attackers exploited an older system, exposing API keys.
- Some users reported significant unauthorized AI service charges.
An older system at OpenCode suffered a security breach, compromising API keys for approximately 1.4% of users on its OpenCode Console platform. The attackers reportedly used a large-scale distillation attack, leading some users to report significant unauthorized charges on their AI service accounts. OpenAI, Anthropic, and Google have taken steps to block exposed keys and restore access.
This incident underscores the growing difficulty in defending against AI-driven cyberattacks, particularly for companies without access to highly-vetted AI models with robust safety features. OpenCode's co-founder noted that the company's own defensive AI agents struggled when malicious code activated safety filters. Access to OpenAI's Daybreak Blue program aided their investigation.
The situation is ongoing, with OpenCode detailing the breach on X and notifying affected users via email. The company has advised users to revoke and replace their API keys. This breach follows similar incidents, such as one at Hugging Face, where AI models hindered security analysis due to safety restrictions, highlighting a broader challenge in cybersecurity.
