OpenCode Console Breach Exposes API Keys, Runs Up Unauthorized AI Charges

OpenCode, an open-source AI coding agent gaining traction as an alternative to Claude Code and Cursor, disclosed Saturday that attackers broke into an older system overnight, affecting 1.4% of users of its online platform, OpenCode Console, where some users store the API keys they use to access AI services.

The company said it notified all affected users by email and that anyone who did not receive an email was not impacted. Co-founder Dax Raad stressed that the exposed keys were confined to Console workspaces and that the open-source app and command-line tool were unaffected. "Those keys never come to us," he wrote on X.

Overnight, developers reported spending alerts and unauthorized charges on Reddit and X, with some citing hundreds of dollars on individual accounts and a few describing totals above $1,000. Anthropic and Google blocked the API keys they believed were exposed, while OpenAI said it worked with OpenCode to restore access and refund its API customers for credits used in the attack. OpenCode said refunds for unauthorized charges are underway.

OpenCode described the incident as a "large-scale distillation attack," though some skeptics called that framing an overstretch, arguing it was a straightforward breach whose use for distillation remains unproven. The company has not detailed how attackers gained access, how keys were stored, or the full extent of any misuse, and said the incident remains ongoing. It has told affected users to revoke and replace their keys directly with each provider.

Raad said attackers had tried to break into its systems nonstop for 48 hours, forcing the team to keep AI defensive agents running around the clock. AI models the team turned to for analysis eventually refused to work when malicious code they were asked to examine tripped safety filters. OpenCode later received access to OpenAI's Daybreak Blue program, which gives vetted users models less likely to refuse defensive security requests, improving its ability to investigate.

The episode echoed a similar wall hit by Hugging Face in July, and drew comment from David Sacks, co-chair of the President's Council of Advisors on Science and Technology, who wrote on X that guardrails "backfired" when frontier models refused to analyze the exploits needed for defense. The breach occurred the same night OpenCode made GLM-5.3-Flash free for users.

Source: TechCrunch