Open Code

An intruder reached a legacy system OpenCode was already preparing to shut down, exposing the third-party API keys, OpenAI and Anthropic among them, that 1.4% of Console users had saved in their workspaces. The company ties it to a large-scale distillation attack but has not said how anyone got in, how long they stayed, or how many keys were exposed. By choosing to publish a low percentage figure as the "victim" count Open Code is obfuscating the fact that the number of victims is probably in the several thousands and that the exposed keys must be remediated by the same victims that trusted Open Code with their security.