Hackers hit AI coding tool OpenCode, running up charges on users' AI accounts
The developers of OpenCode, an open-source AI coding agent, said attackers broke into an older system overnight and affected 1.4% of users of its online platform, OpenCode Console. Users reported unauthorized charges for AI services, some in the hundreds of dollars.
OpenCode, an open-source artificial intelligence (AI) coding agent that developers use as an alternative to Claude Code and Cursor, disclosed a security incident on Saturday. Attackers broke into an older system overnight and affected 1.4% of users of OpenCode Console, an online platform where some users store API keys, the digital passwords used to access AI services. The company linked the incident to a large-scale distillation attack and emailed all affected users. Anyone who received no email was not affected.
Unauthorized charges
On Reddit and X, developers began posting spending alerts and unauthorized charges. Some reported bills in the hundreds of dollars on a single account, and a few cited totals above $1,000. Anthropic and Google blocked the keys they believed had been exposed. OpenAI worked with OpenCode to restore access and said it would refund its API customers for credits used in the attack. OpenCode says refunds for the unauthorized charges are under way.
The company did not specify how the distillation occurred. Leaked API keys can help users in countries with restricted access to American models produce the high volume of outputs that the process requires. Some skeptics argued that the incident was a straightforward breach and that its use for distillation remains unproven.
Model restrictions hampered defense
According to co-founder Dax Raad, the open-source app and command-line tool were not affected, because the keys never reach OpenCode itself and were confined to Console workspaces. Attackers had been trying to break into its systems nonstop for 48 hours, so the team kept AI defensive agents running around the clock. The AI models used for analysis helped at first but began refusing to work when the malicious code triggered safety filters. OpenCode later gained access to OpenAI's Daybreak Blue program, which gives vetted users models less likely to refuse defensive security requests.
In July, the AI platform Hugging Face described a similar problem. David Sacks, co-chair of the President's Council of Advisors on Science and Technology in the United States, also commented on the incident.
OpenCode has not explained how the attackers reached the older system or how the keys were stored. Affected users have been told to revoke and replace their keys directly with each provider. The company says the incident is ongoing.
