OpenCode says breach exposed API keys and triggered unauthorized charges
🎧 Listen to this story
OpenCode said attackers accessed an older system powering OpenCode Console, affecting 1.4% of the platform’s users. Some API keys stored by users were exposed, and developers reported unauthorized charges on OpenAI, Anthropic and Google accounts, including cases in the hundreds of dollars and some above $1,000. Anthropic and Google blocked keys they considered compromised; OpenAI said it worked with OpenCode to restore access and refund credits used in the attack. OpenCode said refunds are underway.
According to co-founder Dax Raad, the open-source app and command-line tool were not affected. During the response, AI models refused to analyze malicious code after triggering safety filters. Raad said later access to OpenAI’s Daybreak Blue program improved the investigation. The episode renewed criticism that safeguards can hinder defensive security teams.
Why it matters · editorial interpretation
The incident may prompt developers who store keys on third-party platforms to review access controls, credential exposure, and spending limits. The response also renews, according to the report, the tension between model safety filters and defensive investigations of malicious code.
Sources
Security