Hackers breached OpenCode Console and stole API keys from 1.4% of users. Attackers then used those keys to run up unauthorized charges on AI accounts. OpenCode notified affected users by email on the same morning. Anthropic and Google blocked exposed keys while OpenAI refunded affected customers. The open source app and CLI were not impacted. OpenCode struggled to analyze malicious code as AI models refused to process it. The team later gained access to OpenAI’s Daybreak Blue program for less restricted models. The incident remains ongoing with refunds underway. Attackers targeted OpenCode for 48 hours straight. Some users reported charges in the hundreds or over $1,000.
What changed
API keys were stored securely and not exposed to attackers.
What it unlocks
Attackers could use stolen API keys to generate high-volume AI outputs.
- 1.4% of OpenCode Console users affected
- 48 hours of sustained attack
- charges above $1,000 on some accounts
What you need to act on it
- use of OpenCode Console
- stored API keys in workspaces
Sources