OpenCode Breach Exposed Stored API Keys and Drove Up AI Bills

Attackers broke into an older OpenCode system affecting 1.4% of OpenCode Console users and used stored API keys to run up charges on those users' third-party AI accounts. OpenCode disclosed the incident on Oct. 19, describing it as a large-scale distillation attack, or mass automated queries used to copy model behavior. TechCrunch

OpenCode is an open-source AI coding agent, software that writes and edits code with AI help. OpenCode Console is its hosted companion, an online platform where some users store API keys, the secret codes that let programs use paid AI services. The exposed keys were confined to Console workspaces. The open-source app and command-line tool were not affected.

Developers reported surprise spending alerts and charges on OpenAI, Anthropic and Google AI accounts. Some charges were in the hundreds of dollars, a few above $1,000. The pattern fits bulk inference abuse, heavy use of paid AI requests. A stolen key gives direct access to a metered service, so large-scale querying can burn through credit quickly, before rate limits or billing alerts trip. TechCrunch

Containment centered on the providers. Anthropic and Google blocked keys they believed were exposed. OpenAI worked with OpenCode to restore access and refund API customers for credits used in the attack. Refunds for unauthorized charges are underway.

OpenCode said it notified all affected users by email on the morning after the breach. Users who did not get that email were not affected. Co-founder Dax Raad said attackers tried to break in nonstop for 48 hours. OpenCode also received access to OpenAI's Daybreak Blue program, which gives vetted users access to AI models less likely to refuse requests for defensive security work. TechCrunch

The command-line tool was untouched. That limit kept the damage contained. Self-hosted setups that keep keys in local environment files or secret stores were outside the affected group. Only keys saved in Console workspaces were at risk.

The broader context here will be familiar to anyone who has run shared developer tools. Storing keys in one hosted console avoids scattered copies on many machines, but it creates a single high-value target. The trade can still be worth it, but it requires strict separation between workspaces, encryption at rest with separate keys per customer, short-lived tokens where providers support them, and spend caps and anomaly alerts on by default. Provider-side revocation worked as designed. The gap was detection and time to revocation during 48 hours of sustained attempts.

In my view, the durable fix is not to avoid hosted coding agents. It is to treat model API keys like production cloud credentials. Scope them narrowly, rotate them automatically, keep hard billing limits on development keys, and hold them outside the agent when possible through a proxy or vault. Those steps add friction. They also turn a theft from an open-ended billing incident into a contained revocation, which is why most users here could recover with refunds and reissued keys.