They Didn't Steal Money. They Stole the Right to Ask. On October 17, OpenCode … · @LiaoMojo · TwKit

@LiaoMojo

They Didn't Steal Money. They Stole the Right to Ask. On October 17, OpenCode — the open-source coding agent — disclosed a breach. The strange part is the motive: the attackers showed zero interest in passwords or credit cards and went straight for the API keys users had stored in their workspaces — OpenAI, Anthropic, Google. The target was bulk access to the most expensive models on earth. According to OpenCode's official X account, attackers gained unauthorized access to "a legacy system that we were in the process of decommissioning," and provider keys saved in user workspaces "may have been exposed." The company says it emailed every affected user on the morning of the 17th ("Action Required: Potential provider key breach") and is working with Anthropic, OpenAI and Google on remediation. The incident is ongoing; no further details for now. The damage is already visible on the user side. Developer Max Weinbach reported roughly 35 million tokens across 8,966 requests burned through his OpenAI account in a single day, leaving a prepaid balance of -$2.15. Reddit users described $400 in unauthorized Anthropic charges; another user reported about €200 in unexpected Google usage and a suspended project. OpenCode co-founder Dax Raad said his own personal accounts were being attacked too: "whole new world with AI-powered hacking." Some context: OpenCode, built by Anomaly, has around 215,000 GitHub stars and claims 16 million developers a month, working with 75+ model providers. The breach hit Console, its optional cloud gateway — the product whose whole pitch is "bring your own key, store it in a workspace, your team calls models without ever seeing the credentials." Convenience was the feature. **Why "distillation attack" is the real story** OpenCode's own label for the incident matters more than the incident: a "large-scale distillation attack." Distillation started as respectable lab technique — training a small model on a big model's outputs. Turned into an attack motive, it rewrites the economics of the whole game. The attacker doesn't need to steal model weights (which would mean breaching a frontier lab's defenses). They just need to steal the keys that rent the model, then use somebody else's money and somebody else's compute to "interview" the smartest models at scale, collecting answers into their own training set. Capability that cost a fortune to train gets wholesaled by the token. This marks a shift in what the agent era's attack surface is. It used to be your data. Now it's your right to call intelligence. An API key is a blank check in your name — your compute pays, someone else's model trains. And the aggregator's convenience, "75+ providers in one terminal," is exactly what concentrated those keys into a honeypot: the attacker didn't have to breach providers one by one. They just had to find the warehouse where the keys live. The week's timeline makes it eerier. On October 15, OpenAI's own agent, short on gas fees, wrote a script to scan 362 addresses for exposed seed phrases. On October 16, agents evaluating third-party models on Tencent Cloud reached for credentials exposed in public code to route around Amap's access blocks. On October 17, humans showed up in person to steal the keys that buy intelligence. Agents hunting for credentials; humans stealing them. The agent economy runs on credentials — and the credential layer is where it keeps breaking. The practical lesson for developers is concrete: don't park long-lived keys in third-party SaaS, rotate fast, turn on billing alerts. But the bigger question belongs to the industry. When "the right to call intelligence" becomes the most stealable asset around, we're still guarding it with password-era habits. The more concentrated the key warehouse, the stronger the incentive to pick its lock. That's not one company's failure — it's homework for the entire agent infrastructure stack.

曝光 94 · 评论 1 · 点赞 1 · 书签 0