Hackers Breached OpenCode’s Platform, Stealing API Keys and Running Up Charges on Users’ AI Accounts
Attackers compromised keys for 1.4% of OpenCode Console users in October 2026, triggering unauthorized AI-service charges ranging from hundreds to over $1,000. OpenAI, Anthropic, and Google blocked exposed keys; OpenCode’s open-source app and CLI were unaffected.
OpenCode, an open-source AI coding agent used as an alternative to Claude Code and Cursor, disclosed Saturday that attackers broke into an older system overnight, compromising API keys belonging to 1.4% of users on its OpenCode Console platform. The breach, which the company said occurred in October 2026, resulted in unauthorized charges on users’ AI service accounts — some in the hundreds of dollars, with a few exceeding $1,000.
The stolen keys were stored in Console workspaces and provided access to AI services including OpenAI, Anthropic, and Google. OpenCode co-founder Dax Raad confirmed the open-source app and command-line tool were not affected. “Note this is the OpenCode Console, not OpenCode itself, those keys never come to us,” he wrote on X. Anthropic and Google blocked the exposed keys, while OpenAI said it worked with OpenCode to refund affected API customers. OpenCode said refunds for unauthorized charges are underway.
OpenCode framed the incident as a “large-scale distillation attack,” suggesting the stolen keys may have been used to generate high volumes of AI outputs. Some observers disputed that characterization, calling it a straightforward breach whose connection to distillation remains unproven.
The response effort exposed a broader challenge: AI models the OpenCode team used for defensive analysis eventually refused to continue when the malicious code triggered safety filters. “That was a bit frustrating,” Raad wrote. The team later received access to OpenAI’s Daybreak Blue program, which provides vetted users with models less likely to refuse security-related requests, improving their ability to investigate.
The episode drew attention from David Sacks, co-chair of the President’s Council of Advisors on Science and Technology, who noted that both OpenCode and Hugging Face — which faced a similar issue in July — hit the same wall mid-attack. “The guardrails backfired,” he wrote on X.
OpenCode has not disclosed how attackers gained access to the older system or how keys were stored. The company told affected users to revoke and replace their keys directly with each provider and said the incident remains ongoing.