OpenCode Hack Exposes API Keys Amid AI Distillation Attacks
OpenCode said 1.4% of Console users were affected, and some reported more than $1,700 in unauthorized charges overnight.
- OpenCode disclosed a security breach involving a large distillation attack that potentially exposed API keys for Anthropic, OpenAI, and Google, affecting 1.4% of OpenCode Console users on Saturday.
- Dax Raad, OpenCode co-founder, stated attackers targeted company systems for 48 hours using AI agents, with unauthorized access to credentials beginning at 00:30 UTC on October 17, 2026.
- Multiple users reported unauthorized charges exceeding $1,700 overnight, while Google Cloud suspended projects after detecting abusive activity, though no user data was exposed during the breach.
- Stabilization occurred after OpenCode began using OpenAI's Daybreak AI cybersecurity model for defensive work, which the company was approved to use on Saturday.
- The Blue Report 2026 measures defensive techniques across 338 million simulations, underscoring risks when developers link external API providers and attackers leverage automated agents.
25 Articles
25 Articles
Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts
OpenCode is an open source AI coding agent that's become a popular alternative to Claude Code and Cursor. But hackers got into part of its online platform and stole some users’ API keys, and the AI tools it turned to for help kept refusing to look at the malicious code.
The developer reported that the attackers hacked its artificial intelligence coding tool OpenCode by charging fees to the accounts of users with artificial intelligence.
OpenCode breach exposes AI credentials, triggers unauthorized charges
AI coding platform OpenCode disclosed a security breach affecting 1.4% of its Console users after attackers accessed a legacy system, potentially exposing API keys for OpenAI, Anthropic and Google AI services. Malware Update / affiche
AI coding platform OpenCode disclosed a security break affecting 1.4% of its Console users after attackers accessed a legacy system, potentially exposing API keys for OpenAI, Anthropic and Google AI services. Malware Update / poster
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
