If you've used the AI coding assistant OpenCode, go check if you've been charged unexpectedly. Last night, someone hacked into one of their old systems that was about to go offline and ended up stealing some users' third-party API keys stored there. The attacker used the stolen keys to make massive calls to these AI models, scraped the model outputs, and used them to train their own models—while the costs were charged to your account. The official statement calls this a large-scale distillation attack. Some users have already received abnormal billing alerts. Anthropic, OpenAI, and Google all have cases of unauthorized charges. Right now, they're working with these three companies to figure out a solution.