On October 17, OpenCode informed some of its users via email, that there was a security incident and their API keys has been potentially compromised. In this video, I will tell you why it's important not only for those who are using OpenCode, but in general to all of us who are somehow linked to AI, AI programming, AI usage of such tools as Claude Code, ChatGPT. So first of all, what is OpenCode? OpenCode is an open source alternative to such tools as Claude Code or OpenAI Codex. And what it does, you basically just provide API keys from Anthropic, from OpenAI, or from any other chat provider to OpenCode, which you install on your computer, Then OpenCode is using your keys to access these model providers, and it behaves in a very similar way as Claude Code or Codex from OpenAI.
So everything is fine. The problem is that if this tool or the tools like OpenCode are compromised, then potentially all your API keys will be available to other companies. Let's say it's a kind of a lab. It can be in any country. Mostly, people say that it's Chinese labs who are distilling the models. So OpenCode said that this attack was linked to a large scale distillation attack. What does it mean? It means most probably the following. I'm not 100% sure here because they do not disclose details.
But your API keys from providers which you gave to console product from OpenCode has been potentially leaked to some labs which are using these keys to request different models, mostly frontier models from big frontier companies like OpenAI and like Anthropic to get an understanding of how these models are working. So they're not getting access to the weights of these models, but they can ask questions and receive answers. And in this way, they try to mimic how these models work and recreate their own versions which are normally super powerful.
And why it's important for all of us, it's important to know that if you are giving your API key to any kind of product, it can be not only OpenCode, but anything else. They may be potentially leaked, then all your balance in the account which you topped up will be drained. So couple of recommendations here which I potentially use. So first of all, I do not keep a lot of funds on my API keys. I set the limits. I can, let's say, set the limit to €90, €100 of spend so that in the end, if someone gets access, the maximum amount they can spend will be this one.
And the second is, when I need to provide my keys to anyone, it can be such harnesses as Hermes or anything else. I think two times about the team, which is behind these products, about the potential security vulnerabilities. And if the product I don't know or I do not really trust, I just don't use it, and I don't provide my keys out of this product. And the third thing which you should also do, you should rotate your API keys. It means that you should just log in into your provider of the models, let's say, to platform.openai.com or to Anthropic, and just deactivate the previous API keys you had, and you'll be issued with the new ones.
And then you can use these new ones with the products which you're using. Thank you for watching, and see you in the next video. Bye.
