Hackers breach OpenCode Console and run up charges on user AI accounts
Attackers exposed API keys stored in an older system, and some users reported bills above $1,000.
Code#07
1.4%
Share of OpenCode Console users affected by the breach
Image: TechCrunch
1.4%Share of OpenCode Console users affected by the breach
The short version
- OpenCode, an open source AI coding agent, said attackers broke into an older system overnight.
- The breach affected 1.4% of users of OpenCode Console, where some users store API keys.
- Developers reported unauthorized charges on their OpenAI, Anthropic and Google AI accounts, with some totals above $1,000.
- Anthropic and Google blocked the exposed keys, and OpenAI said it would refund API customers for credits used in the attack.
Why it matters
The incident shows how stored API keys can become a direct financial risk for developers using AI services. It also shows that AI models with safety filters can slow down defenders during an active attack. OpenCode said the open source app and command-line tool were not affected.
“Note this is the OpenCode Console, not OpenCode itself, those keys never come to us”