Artificial Intelligence

OpenCode Breach Leaks API Keys, Drains AI Accounts Overnight

Does the Console breach expose dangerous gaps in AI credential security or does the swift response prove the industry's resilience?

5 hours ago·Updated 1 hour ago

OpenCode Breach Leaks API Keys, Drains AI Accounts Overnight

Story

Above: OpenCode home screen. Image credit: OpenCode

The Facts

OpenCode, an open-source AI coding agent, said Saturday that an intruder accessed an older system overnight, affecting 1.4% of OpenCode Console users, where some developers store API keys. The company said the breach was “related to a large-scale distillation attack." It emailed those affected and said it was working with Anthropic, OpenAI and Google.
OpenCode on X
TechCrunch
CyberSecurityNews
Co-founder Dax Raad wrote on X on Sunday that attackers had been "non stop trying to attack our systems for the past 48 hours," adding that one side effect was that the company's systems were being "hardened." OpenCode said the incident remained ongoing.
Dax Raad on X
TechCrunch
The Hacker News
Anthropic and Google blocked API keys they believed were exposed, and OpenAI said it worked with OpenCode to restore access and refund credits used during the attack. OpenCode said it was processing refunds for unauthorized charges.
36Kr
TechCrunch
Developers reported unauthorized charges on their own accounts, including $400 of Anthropic usage and, for one user, $281 of OpenAI and $168 of Anthropic usage. Others reported totals above $1,000, including one user who reported losses of $1,700.
36Kr
The Hacker News
The credentials at risk were those pasted into Console, as Raad said the breach involved "the OpenCode Console, not OpenCode itself." Keys added through the command-line and desktop apps remain stored on the user's own machine.
X
Infosecurity Magazine
The Hacker News
Notified users were told to revoke and replace provider keys through each dashboard, update applications that rely on them and review recent usage. Security firm Safeguard advised checking billing records from Oct. 16 onward and setting spending limits.
Infosecurity Magazine
CyberSecurityNews

Sources Split

LEFT

CENTER

RIGHT

ESTAB
CRIT

CENTER

PRO
ESTAB

The Spin

Narrative A

This breach exposed vulnerabilities in Console infrastructure, putting stored AI provider API keys at risk. The incident raises urgent questions about credential protection, incident response and financial safeguards across AI development platforms, as that gap is where the next breach starts.

Prasenjit Sarkar on X

Hugo Guerrero on X

Narrative B

OpenAI and OpenCode worked closely to help affected users who rely on OpenAI API services get back in business quickly and to refund credits for eligible usage consumed during the attack. This shows that AI firms are committed to helping developers recover and stay resilient.