OpenCode breach exposed API keys for 1.4 percent of Console users

Any team that handed its OpenAI, Anthropic or Google API keys to a vendor for safekeeping has to ask what happens the day that vendor is breached. OpenCode's weekend attack is that day for 1.4 percent of its Console users, who are now revoking and replacing keys that showed unauthorized charges overnight.

TechCrunch reports that attackers broke into an older OpenCode system on Saturday and reached the OpenCode Console, where some users store the API keys they use to call AI providers. OpenCode said on X that the breach affected 1.4 percent of Console users and that it had emailed every one of them. Users who did not receive an email were not affected.

What was stolen and what to do

Developers started posting unauthorized charges on Reddit and X overnight, with some reporting totals above $1,000 on individual accounts. Anthropic and Google blocked the API keys they believed were exposed, and OpenAI said it worked with OpenCode to restore access and refund credits used in the attack. OpenCode said refunds for its own users are underway.

The exposed keys were confined to OpenCode Console, where some users had stored them in workspaces. The open-source OpenCode app and command-line tool were not affected, according to co-founder Dax Raad, who told TechCrunch the keys "never come to us" in that path. Anyone who used Console workspaces should revoke and replace keys directly with each provider.

The defenders ran into their own filters

Raad also told TechCrunch that attackers kept probing OpenCode's systems for 48 hours, forcing the team to run defensive AI agents around the clock. Several frontier models the team used for analysis started refusing to look at the malicious payloads, because the exploits tripped safety filters. OpenCode later got access to OpenAI's Daybreak Blue program, which gives vetted users models with fewer refusals for defensive work, and Raad said that improved the investigation.

OpenCode is not the first to hit that wall. Hugging Face described the same problem in July, writing in a blog post titled "The asymmetry problem" that guardrails "cannot distinguish an incident responder from an attacker."

For any team evaluating where to hold provider credentials, the lesson is the structure of the trust rather than the brand. A single store that holds keys for every provider becomes a single breach point for every provider, and the recovery is as many rotations as providers you called through it.

Source

Hackers hit AI coding tool OpenCode, running up charges on users' AI accounts, by Aditya Mehta at TechCrunch.