Hackers Expose 1.4% of OpenCode Console Users' API Keys, Triggering $1,000-Plus AI Charges
Updated
Updated · TechCrunch · Oct 19
Hackers Expose 1.4% of OpenCode Console Users' API Keys, Triggering $1,000-Plus AI Charges
3 articles · Updated · TechCrunch · Oct 19
Summary
OpenCode said attackers breached an older Console system overnight, exposing API keys for 1.4% of users and triggering unauthorized AI usage that in some cases topped $1,000.
Anthropic and Google blocked affected keys, while OpenAI said it worked with OpenCode to restore access and refund API credits; OpenCode said its own refunds are underway and unaffected users were not emailed.
OpenCode said the breach was limited to OpenCode Console workspaces, not its open-source app or command-line tool, but the incident was still ongoing as attackers kept probing its systems for 48 hours.
AI safety filters complicated the response: co-founder Dax Raad said defensive analysis tools began refusing to inspect malicious code, and access to OpenAI's Daybreak Blue program later improved the investigation.
The episode adds to a string of AI-enabled cyber incidents and sharpens complaints from security researchers that model guardrails can also block legitimate incident response.