Hackers breach OpenCode Console, running up charges on users' AI accounts
The open source coding tool says 1.4% of Console users were affected. Some developers reported unauthorized charges above $1,000, according to TechCrunch.
Attackers broke into an older system at OpenCode overnight. They exposed API keys that some users had stored on its online platform and ran up charges on those users' AI accounts, according to TechCrunch.
OpenCode is an open source AI coding agent. On Saturday it said the breach affected 1.4% of users of OpenCode Console, the platform where some users keep the API keys they use to access AI services.
“We had a security breach last night related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users. We have notified them all this morning via email.”OpenCode, on X
The company said users who did not receive an email were not affected.
Developers posted spending alerts and unauthorized charges on Reddit and X overnight. TechCrunch reported that some individual accounts showed charges in the hundreds of dollars, and a few users described totals above $1,000. Anthropic and Google blocked the keys they believed were exposed. OpenAI said it worked with OpenCode to restore access and refund its API customers for credits used in the attack. OpenCode said refunds for unauthorized charges are underway.
Co-founder Dax Raad said the open source app and command-line tool were not affected. "Note this is the OpenCode Console, not OpenCode itself, those keys never come to us," he wrote on X.
The incident also shows how hard it can be for small companies to defend against large-scale attacks. Raad said attackers had tried to break in nonstop for 48 hours, so the team kept AI defensive agents running around the clock. The AI models the team used for analysis helped for a while. Then they started refusing to work when the malicious code they were asked to examine triggered safety filters. OpenCode later got access to OpenAI's Daybreak Blue program, which gives vetted users models that are less likely to refuse defensive security requests. Raad said this improved the team's ability to investigate.
TechCrunch noted that Hugging Face reported a similar problem in July. David Sacks, co-chair of the President's Council of Advisors on Science and Technology, wrote on X that "The guardrails backfired."
Much is still unclear. OpenCode has not said how attackers got into the older system, how the keys were stored, or how far any misuse went. It also has not said how the distillation attack happened. TechCrunch reported that some skeptics called that framing an overstretch, saying the incident was a straightforward breach and that any use for distillation remains unproven.
OpenCode has told affected users to revoke and replace their keys directly with each provider. The company said the incident remains ongoing.
