Attackers breach OpenCode Console and charge users’ AI API keys
Original title: Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts
About 1.4% of Console users had stored API keys exposed; the open-source app itself was not affected.
OpenCode said attackers broke into an older system overnight and exposed API keys held by 1.4% of OpenCode Console users. Developers reported unauthorized OpenAI, Anthropic and Google spend, including some totals above $1,000. The company called it a distillation attack, which skeptics dispute, and said refunds are underway. It has not explained the access path, and the incident remains ongoing.
Unconfirmed: How the older system was breached, and whether the keys were used for distillation, is unproven.
- Users who did not receive an email were not impacted.
- Exposed keys were limited to Console workspaces, not the CLI.
- Anthropic and Google blocked keys they believed were exposed.
- OpenAI said it refunded API credits used in the attack.
- Affected users were told to revoke and replace keys with each provider.
Impact: Exposed AI API keys and unauthorized provider charges
- 1.Revoke and replace exposed API keys directly with each provider.
- ATT&CK
- T1078 Valid Accounts
- Products
- OpenCode ConsoleOpenCode
From the original article
4 min read at techcrunch.com
OpenCode is an open-source AI coding agent that's become a popular alternative to Claude Code and Cursor. But hackers got into part of its online platform and stole some users’ API keys, and the AI tools it turned to for help kept refusing to look at the malicious code.
By Aditya Mehta · techcrunch.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.