OpenCode Console breach exposed user API keys and spent AI credits

If you kept a provider API key inside a coding-agent service, the way you find out it was exposed is overnight charges on your account.

TechCrunch reports that attackers broke into an older system at OpenCode, an open-source AI coding agent, and exposed the OpenAI, Anthropic and Google API keys that some users had stored inside OpenCode Console, the hosted platform. OpenCode said in a post on X that the breach impacted 1.4 percent of OpenCode Console users and that it had emailed everyone affected. Users who did not get an email were not impacted. The open-source app and command-line tool were not touched: those keys never reach OpenCode, co-founder Dax Raad said on X.

The charges users saw

Developers began posting spending alerts and unauthorised charges on Reddit and X overnight. One wrote that OpenAI, Anthropic and Google spend alerts fired at the same time before bedtime. TechCrunch reports some users saw charges in the hundreds of dollars on individual accounts and that a few described totals above $1,000. Anthropic and Google blocked keys they believed were exposed, OpenAI said it worked with OpenCode to restore access and refund API credits used in the attack, and OpenCode said refunds for unauthorised charges are underway.

OpenCode has not detailed how attackers reached the older system, how the keys were stored, or the full extent of any misuse, TechCrunch reports. It has told affected users to revoke and replace their keys directly with each provider. The company says the incident is ongoing.

What was behind the "distillation" framing

OpenCode called the incident a "large-scale distillation attack", meaning the stolen keys were used to generate high volumes of model outputs that could then be used to train another model. TechCrunch reports some skeptics called that framing an overstretch and argued the incident was a straightforward breach whose use for distillation remains unproven. Leaked keys can help users in countries with restricted access to American models generate the volume of outputs needed for distillation, TechCrunch adds.

What the OpenCode team ran into mid-incident

Raad said attackers kept trying to break into OpenCode's systems for 48 hours, which required the team to keep defensive AI agents running without a break. The commercial AI models they used for analysis started refusing to work when the malicious code they were asked to examine tripped safety filters, which he called frustrating. OpenCode later got access to OpenAI's Daybreak Blue program, which gives vetted users models that are less likely to refuse requests for defensive security work.

TechCrunch reports Hugging Face ran into the same problem earlier this year, when commercial AI models blocked its attempts to analyse logs from an intrusion by autonomous AI agents. In a section of its blog post titled "The asymmetry problem", Hugging Face wrote that guardrails "cannot distinguish an incident responder from an attacker".

David Sacks, co-chair of the President's Council of Advisors on Science and Technology, wrote on X that OpenCode and earlier Hugging Face ran into the same refusal mid-attack and that the guardrails worked against them.

If you kept a provider API key in OpenCode Console, treat it as compromised, rotate it with each provider, check your bill, and ask your provider about a refund on anything you did not authorise.

Source

Hackers hit AI coding tool OpenCode, running up charges on users' AI accounts by Aditya Mehta, TechCrunch. OpenCode's own statement on X.