Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts
The open-source AI coding tool OpenCode suffered a security breach that exposed API keys for 1.4% of its users, leading to unauthorized charges on their AI service accounts. The incident highlights the security risks associated with managing API keys in third-party AI development environments.
Why it matters
As AI tools become more integrated into developer workflows, the vulnerability of API keys poses a significant financial and security risk to users.
OpenCode , an open-source AI coding agent that has been gaining ground among developers as an alternative to Claude Code and Cursor, said Saturday that attackers broke into an older system overnight, affecting 1.4% of users of its online platform, OpenCode Console, where some users store the API keys, or digital passwords, they use to access AI services.
As the OpenCode team struggled to keep pace with the attack, the scramble to respond highlighted a growing problem: companies without vetted access to AI models with fewer safety restrictions have a hard time defending against large-scale, AI-driven cyberattacks.
“We had a security breach last night related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users,” the company wrote on X. “We have notified them all this morning via email.” Users who did not receive an email were not impacted, the company said.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in