OpenCode stated that attackers breached an old OpenCode Console system, affecting 1.4% of users and exposing some users’ API keys. This resulted in unauthorized charges from OpenAI, Anthropic, and Google AI.
The incident was limited to the Console. The open-source app and command-line tools were not affected.
Key Points from the Incident
The key issue is that the vulnerability was in OpenCode Console, an online platform where some users stored API keys in workspaces—not in OpenCode as a whole.
The open-source app and command-line tool were not affected, and their API keys were never sent to OpenCode. Therefore, it would be inaccurate to assume that every OpenCode tool was breached.
When Spending Alerts Went Off at the Same Time
One developer said that spending alerts from OpenAI, Anthropic, and Google AI went off on the same night. They later discovered unauthorized charges on their account.
The risk came from API keys, which function like passwords for accessing AI services, being stored in workspaces on OpenCode Console. If these keys were exposed, attackers could use them to generate large numbers of requests, causing charges to accumulate on the account owner’s bill.
Where OpenCode Fits in the AI Coding Tool Landscape
OpenCode is an open-source coding agent increasingly being used as an alternative to Claude Code and Cursor. It helps developers work with AI throughout the coding process.
OpenCode Console is OpenCode’s online platform, where some users stored API keys in workspaces. This is separate from the open-source app and command-line tool, which sources say were not affected by this incident.
The Console and Core OpenCode Are Separate
The incident affected an old OpenCode Console system, not the core OpenCode product. The exposed keys were stored in the Console workspaces of some users.
| Factor | OpenCode Console | Open-source app and command-line |
|---|---|---|
| Related system | Old Console system | Not involved in the incident |
| Key storage | Some users stored API keys in workspaces | Sources do not specify whether keys were stored |
| Impact | Affected 1.4% of Console users | Not affected |
Therefore, do not assume that every part of OpenCode was breached. The sources provide no comparison between earlier and newer versions; they only identify the scope of the systems involved.
From Exposed API Keys to Hundreds of Dollars in Charges
Imagine storing API keys in a workspace on OpenCode Console and having those keys exposed. Attackers could use them to call AI services, causing spending alerts from OpenAI, Anthropic, and Google AI to appear at the same time. Some users faced charges of several hundred dollars, while others exceeded $1,000.
After discovering the incident, Anthropic and Google blocked the API keys believed to have been exposed. OpenAI worked with OpenCode to refund customers for credits used in the attack. OpenCode also said that refunds for unauthorized charges were in progress.
OpenCode Compared with Claude Code and Cursor
| Factor | OpenCode | Claude Code | Cursor |
|---|---|---|---|
| Tool type | open-source AI coding agent | Service used as a point of comparison | Service used as a point of comparison |
| Role in the report | Presented as an alternative to both services | One of the services OpenCode is compared with | One of the services OpenCode is compared with |
The sources provide the clearest information about OpenCode as an open-source AI coding tool. Claude Code and Cursor are mentioned only as services that OpenCode aims to offer an alternative to. Therefore, this article does not provide enough information to summarize the features or usage differences among the three tools.
Strengths and Points to Watch from This Incident
Pros
- +Notified affected users by email
- +Coordinated with OpenAI, Anthropic, and Google to disable the keys
- +Initiated refunds for unauthorized charges
Cons
- −Has not disclosed how the system was breached or details about key storage
- −The incident is still ongoing
- −Users must revoke and replace their keys with each provider themselves
Costs That Do Not Appear on the First Bill
The damage was not limited to the initial charges. Some users faced costs of several hundred dollars, while others were charged more than $1,000 for unauthorized API usage.
The team also had to spend time investigating the incident and responding to an attack that continued for 48 hours. Users still had to revoke and replace their API keys with each provider themselves, leaving the burden on both account owners and the teams responsible for maintaining the systems.
When AI Models Refuse Work to Prevent an Attack
This incident shows that guardrails still struggle to distinguish defenders from attackers. Dangerous code that security teams need to examine can trigger safety filters, causing models to refuse analytical tasks. Security teams therefore need to rely on models authorized for defensive security work, such as Daybreak Blue.
If you receive an email saying that you were affected, revoke the relevant API keys and replace them with new keys through each provider, following OpenCode’s instructions.