OpenCode discloses breach as users report unauthorized AI account charges

OpenCode users reported unexpected bills across their AI accounts after attackers breached an older system belonging to the coding-tool company. OpenCode says the incident affected 1.4% of its online Console users. Exposed access keys prompted providers to block credentials and arrange refunds, while the company said the incident remained ongoing.

A Console breach becomes an AI bill

The affected service was OpenCode Console, an online platform where some users kept API keys in their workspaces. These keys act as digital passwords, letting software use an AI provider's models on an account holder's behalf. The affected users had external providers linked, including Anthropic, OpenAI and Google.

That connection explains how a breach at a coding-tool company can produce charges elsewhere. As StepSecurity explains, an attacker with a linked credential can send model requests against the victim's provider account. The account owner then sees spending they did not authorize, even though the credential was exposed through another service.

Developers began posting spending alerts and unauthorized charges on Reddit and X. TechCrunch reported that some users described hundreds of dollars in charges on individual accounts; a few reported totals above $1,000. Those are user-reported bills, not a published tally of the incident's overall financial damage.

Note this is the OpenCode Console, not OpenCode itself, those keys never come to us

Dax Raad, OpenCode co-founder, on X, as quoted by TechCrunch

Providers block keys as refunds begin

Raad said the open-source application and command-line tool were not affected. The distinction narrows the incident to the hosted Console rather than everyone using OpenCode to write software. OpenCode also said it emailed every affected user and that people who received no notification were not impacted.

Anthropic and Google blocked keys they believed had been exposed. OpenAI said it worked with OpenCode to restore access and refund API customers for credits consumed in the attack. OpenCode separately said refunds for unauthorized charges were underway and told affected users to revoke and replace their keys directly with each provider.

The investigation also ran into a different obstacle. Raad said AI models initially helped analyze malicious code, then began refusing requests when that code triggered safety filters. He said OpenCode subsequently obtained access to OpenAI's Daybreak Blue program, which gives vetted users models less likely to reject defensive security work, improving the team's ability to investigate.

The attack's purpose remains disputed

OpenCode described the breach as related to a large-scale distillation attack. In that process, large volumes of model outputs are generated for use in training another model. But the company has not explained the connection, and TechCrunch reported criticism that the distillation framing was unproven. Unauthorized use of keys does not, by itself, establish that purpose.

OpenCode has not disclosed how attackers entered the older system, how the exposed keys were stored or the full extent of their misuse. Those details remain unresolved as affected users address their accounts. StepSecurity's response guidance focuses on three checks rather than treating an installed copy of OpenCode as proof of exposure:

• Check for OpenCode's notification email and identify which external AI providers were linked to the Console account.
• Revoke and replace connected API keys through the relevant providers, following OpenCode's advice to affected users.
• Review each provider's usage dashboard for requests and spending the account holder did not authorize.