🚨🔑 Hackers breached OpenCode, a popular open-source AI coding tool, breaking into a legacy system it was actually in the process of shutting down. Stolen credentials included OpenAI, Anthropic, and Google API keys that developers had saved to use AI models through the platform. Some users reported unauthorized charges from the hundreds of dollars up past $1,700, with the attack described as a large-scale "distillation attack," using someone else's stolen access to harvest AI model outputs at their expense.
This wasn't a password leak, it's worse. A stolen password gets someone into one account. A stolen API key is more like a live line of credit against your wallet, usable instantly from anywhere, until someone notices the bill.
If you use OpenCode Console, revoke and replace any linked API keys immediately and check your provider billing for anything you didn't authorize.
TechCrunchHackers hit AI coding tool OpenCode, running up charges on users’ AI accounts | TechCrunchOpenCode is an open source AI coding agent that's become a popular alternative to Claude Code and Cursor. But hackers got into part of its online platform and stole some users’ API keys, and the AI tools it turned to for help kept refusing to look at the malicious code.