The open-source AI programming tool OpenCode has been hacked, impacting roughly 1.4% of OpenCode Console users and leading to the exposure of some third-party model API keys stored in cloud services. Multiple developers have faced anomalous model call charges, with amounts varying from hundreds of dollars up to $1,700. OpenCode has indicated that the incident is linked to a large-scale distillation attack and is presently working in tandem with three model providers—OpenAI, Anthropic, and Google—to tackle the problem. The involved providers have aided affected users in replacing their keys and reimbursing them for the abnormal usage quotas.

In terms of English expression habits, “incurred” is a bit formal and “faced” is more commonly used in daily and tech - related news to describe encountering a situation like abnormal charges. “Assisted” is replaced with “aided” for a bit more variety and natural flow.

OpenCode has made it clear that keys configured in locally - run programs are not uploaded to the server and thus carry no risk of leakage. At present, the complete details of the incident have not been made public. This event has also sparked industry - wide concerns regarding security issues, such as the management of cloud credentials for AI programming tools and the control of AI Agent operation permissions.

“Clarified” is changed to “made it clear” which is a more natural and commonly used phrase in English. “Disclosed” is replaced with “made public” as it is a more straightforward and widely - understood expression in this context.