OpenCode 遭攻击， OpenAI 和 Anthropic等 API 密钥外泄

星***

开源编程智能体 OpenCode 开发商确认，一起大规模蒸馏攻击导致约 1.4% 的 Console 用户存储的 OpenAI、Anthropic 和 Google API 密钥被曝，受影响账户已邮件通知。
公司正与三家厂商协同处置，暂无法确认密钥是否被恶意使用；官方建议在对应平台后台吊销重签密钥、检查 10 月 17 日以来的用量并设置支出上限。

We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate
— OpenCode (@opencode (https://linux.do/u/opencode)) October 17, 2026 (https://x.com/opencode/status/2111519637049319818?ref_src=twsrc%5Etfw)

Startup Fortune (https://startupfortune.com/opencode-breach-exposes-stored-openai-and-anthropic-keys-prompts-urgent-key-rotation/)
Anthropic 已撤销部分托管在 OpenCode Console 的 Claude API 密钥
Lydia Hallie 表示，OpenCode 在昨日遭入侵后已撤销受影响用户的 Claude API 密钥，建议曾将密钥保存在 OpenCode 的用户重新生成。
不过 OpenCode 开发者澄清，泄露来源为 OpenCode Console，密钥并未直接传给 OpenCode 自身。

考拉***

伟大，从来都始于渺小。你要做的，就是 点燃微弱的星火，让它熊熊燃烧 。

发***

拉我 拉我 拉我