Hackers Breach OpenCode Console, Exposing API Keys and Running Up AI Charges

OpenCode, an open-source AI coding agent positioned as an alternative to Claude Code and Cursor, disclosed a security breach on Saturday in which attackers broke into an older system overnight. The incident affected 1.4% of users of its online platform, OpenCode Console, where some users store the API keys they use to access AI services.

The company described the incident on X as a security breach related to a large-scale distillation attack. It said it notified all affected users by email that morning and that users who did not receive an email were not impacted. The company did not specify how the distillation attack occurred, though leaked API keys can help users in countries with restricted access to American models generate the high volume of outputs needed for that process. Some skeptics called the framing an overstretch, arguing the incident was a straightforward breach whose use for distillation remains unproven.

Unauthorized Charges and Refunds

Overnight, developers began posting spending alerts and unauthorized charges on Reddit and X. One developer wrote that OpenAI, Anthropic, and Google AI spend alerts all fired off before going to bed. Other users reported charges in the hundreds of dollars on individual accounts, and a few described totals above $1,000.

Anthropic and Google both blocked the API keys they believed were exposed, while OpenAI said it worked with OpenCode to restore access and refund its API customers for credits used in the attack. OpenCode said refunds for unauthorized charges are underway.

AI Defense Hit Safety Filters

Co-founder Dax Raad said the exposed keys were confined to Console, where some users had them in workspaces, and that the open-source app and command-line tool were not affected. He said attackers had been trying to break into its systems nonstop for 48 hours, requiring the team to keep AI defensive agents running around the clock.

AI models the team turned to for analysis helped for a while but started refusing to work when the malicious code they were asked to examine activated safety filters. OpenCode later received access to OpenAI's Daybreak Blue program, which gives vetted users AI models that are less likely to refuse requests for defensive security work, and Raad said the access improved the team's ability to investigate the attack.

The episode echoes a July incident in which AI platform Hugging Face said commercial AI models blocked its attempts to analyze activity logs from an intrusion by autonomous AI agents. David Sacks, co-chair of the President's Council of Advisors on Science and Technology, wrote on X that the guardrails backfired because they cannot distinguish an incident responder from an attacker.

OpenCode has not detailed how attackers gained access to the older system, how keys were stored, or the full extent of any misuse. It has told affected users to revoke and replace their keys directly with each provider and said the incident remains ongoing.

Sources: TechCrunch