Hackers Stole Saved AI Keys and Left Users With the Bill
Attackers broke into an older OpenCode system and used saved passwords for AI services to run up bills. The break-in affected 1.4% of OpenCode Console users. OpenCode reported it on Oct. 19 and called it a large-scale distillation attack, meaning mass automatic requests meant to copy how a model behaves. TechCrunch
OpenCode is a free coding helper that uses AI to write and edit software. OpenCode Console is its online home base, where some people save their API keys. An API key works like a password that also pays the bill for AI use. Only keys saved in Console workspaces were exposed. The free app and command-line tool were not affected.
Developers saw surprise spending alerts and charges on OpenAI, Anthropic and Google AI accounts. Some bills were in the hundreds of dollars, a few over $1,000. Stolen keys give direct access to paid AI services, so a flood of requests can burn through credit fast, before limits or billing alerts stop it. TechCrunch
The AI companies led the cleanup. Anthropic and Google blocked keys they thought were exposed. OpenAI worked with OpenCode to restore access and pay back customers for credit used in the attack. Refunds are underway.
OpenCode said it emailed all affected users on the morning after the breach. If you did not get that email, you were not affected. Co-founder Dax Raad said attackers tried to break in nonstop for 48 hours. OpenCode also got access to OpenAI's Daybreak Blue program, which lets approved users work with AI models that are less likely to refuse requests for defensive security work. TechCrunch
The command-line tool was untouched. People who ran the helper on their own computers, with keys kept in local files or safe storage, were outside the affected group. Only keys kept in Console workspaces were at risk.
The broader context here is simple. Keeping all keys in one online locker avoids loose copies on many computers, but it makes that locker a valuable target. That setup can still be worth it, but it needs strong walls between users, separate locks for stored data, temporary keys where possible, and spending caps and unusual-use alerts turned on by default. Shutting off keys at the provider worked as planned. The gap was spotting the attack and shutting keys off faster during 48 hours of repeated tries.
In my view, the lasting fix is not to avoid online coding helpers. It is to treat AI keys like bank passwords for important systems. Give them narrow powers, replace them often, set hard spending limits on test keys, and hold them outside the helper when possible with a go-between service. That adds some extra steps. It also turns a theft from an open-ended bill into a contained reset, which is why most users here could recover with refunds and new keys.
