OpenCode says hackers stole some users’ API keys from its Console

In short: OpenCode says attackers broke into an older part of its OpenCode Console and stole some users’ API keys, which led to unauthorized charges on AI accounts.

What happened

OpenCode is an open-source AI coding tool, which means its core software code is publicly available for others to inspect and use. The company said attackers got into an older system overnight and affected about 1.4% of users of OpenCode Console.

OpenCode Console is the web dashboard where some users store API keys, which are like digital passwords that let software use paid AI services. According to OpenCode, the exposed keys were limited to Console, not the open-source app or the command-line tool.

After the incident, some developers reported spending alerts and unexpected bills from AI providers like OpenAI, Anthropic, and Google. Some users said the charges were in the hundreds of dollars, and a few reported totals above $1,000.

OpenCode said it notified impacted users by email and told them to revoke and replace their keys with each AI provider. Anthropic and Google blocked keys they believed were exposed. OpenAI said it worked with OpenCode to restore access and refund affected API customers for credits used in the attack, and OpenCode said refunds for unauthorized charges are underway.

Why it matters

This is a reminder that saving “keys” in online dashboards can be risky, because a stolen key can be used like a stolen credit card number. It also highlights a problem OpenCode described during its response, some AI tools refused to help analyze the harmful code because of safety rules, even though the goal was defense.

Source: TechCrunch AI