Tag
OpenCode suffered a large-scale distillation attack in which the OpenAI, Anthropic, and Google API keys of roughly 1.4% of console users were stolen to siphon tokens for training distilled models. The attackers are likely affiliated with Chinese labs; this marks the first mass distillation attack targeting ordinary consumers, underscoring that individual users have become targets of AI data theft.
The article discusses concerns about third-party evaluators and reports a security incident where attackers stole a METR API key, causing $600,000 in credit consumption due to a fail-open bug.