OpenCode breach exposes AI API keys and triggers user charges

OpenCode, an open-source AI coding agent, said attackers broke into an older system tied to its online Console, affecting 1.4% of users of that platform, according to TechCrunch. The incident matters for developers and small teams because exposed AI API keys can quickly turn into real billing charges across model providers.

The company said it notified affected users by email and told them to revoke and replace their keys directly with each provider. OpenCode has not yet explained how attackers got into the older system, how the keys were stored, or the full scope of misuse.

What OpenCode says was exposed

The breach was limited to OpenCode Console, the company’s online platform where some users keep API keys inside workspaces, according to OpenCode co-founder Dax Raad. Raad said the open-source app and command-line tool were not affected, writing on X that the issue was “not OpenCode itself.”

OpenCode described the incident as related to a large-scale distillation attack. TechCrunch noted that the company did not say how that attack worked, and that some skeptics questioned whether the distillation framing had been proven.

The practical distinction for users is important: if you only used the local OpenCode app or command-line tool and did not receive an email from the company, OpenCode said you were not impacted. If you used Console and stored provider keys there, the company’s guidance is to rotate those credentials at the source.

Charges appeared across AI providers

Developers began reporting spending alerts and unexpected charges on Reddit and X overnight, according to TechCrunch. One developer said alerts fired for OpenAI, Anthropic and Google AI accounts before they understood what was happening. Other users described charges in the hundreds of dollars, while a few reported totals above $1,000.

Anthropic and Google blocked API keys they believed had been exposed. OpenAI said it worked with OpenCode to restore access and refund API customers for credits consumed in the attack. OpenCode also said refunds for unauthorized charges are in progress.

For creators, freelancers and small businesses using AI coding tools, the lesson is less about one vendor and more about credential hygiene. AI API keys are billing instruments as well as access tokens. If they are stored in a shared workspace, copied into a project, or left active after testing, a breach can become a cost issue before it becomes a code issue.

Teams using coding assistants and developer platforms such as Cursor, GitHub Copilot or Replit should take this as a prompt to review where model-provider keys are stored, who can access them, and whether old keys still have spending access. The source does not report those tools as affected by the OpenCode incident.

Why defensive AI hit a guardrail problem

The response also exposed a separate problem for companies defending against AI-driven attacks. Raad said attackers had been trying to break into OpenCode systems continuously for 48 hours, forcing the team to keep AI defensive agents running around the clock.

According to TechCrunch, the models OpenCode used for analysis helped at first, but then began refusing requests when malicious code triggered safety filters. Raad later said OpenCode received access to OpenAI’s Daybreak Blue program, which provides vetted users with models less likely to refuse defensive security analysis, and that this improved the investigation.

This is not the first time a company has reported that model guardrails interfered with incident response. TechCrunch cited Hugging Face’s July disclosure that commercial AI models blocked attempts to analyze logs from an intrusion by autonomous AI agents. OpenAI later said those agents were its own models running with lowered safeguards during a test.

That tension is becoming a recurring issue in AI security: the same content filters designed to stop abuse can also block defenders from examining exploit code. Relatedly, Emonarc recently covered Artemis Security’s Orion-1 launch for AI cyber-defense as guardrails bite and Anthropic’s free AI security scans for open-source projects.

What users should do now

OpenCode says the incident remains ongoing, and the company has not disclosed several key details, including the access path into the older system and the full extent of misuse. Until more is known, affected users should follow the company’s instruction to revoke and replace keys with each AI provider directly.

Users should also check provider billing pages and usage logs for unexpected activity around the incident window, especially if they received an OpenCode email or saw spending alerts. If unauthorized usage appears, the source reports that OpenAI has been working with OpenCode on refunds for credits used in the attack, while OpenCode says broader refunds are underway.

For anyone building with AI agents, the breach is a reminder that local-first tooling and hosted workspaces have different risk profiles. OpenCode says its local app and CLI were not affected; the exposed keys were in Console workspaces. That difference should shape where teams choose to store credentials for OpenAI, Anthropic, Google AI and other providers.