Attackers breached AI coding tool OpenCode's Console, exposing stored AI API keys and running up charges
OpenCode, an open source AI coding agent, said attackers broke into an older system overnight and affected 1.4% of users of its online platform, OpenCode Console, where some users store API keys for AI services. The company linked the breach to a large-scale distillation attack, though skeptics said its use for distillation is unproven. Developers reported spending alerts and unauthorized charges, including on OpenAI, Anthropic and Google AI accounts. Users described charges in the hundreds of dollars, and a few described totals above $1,000. Anthropic and Google blocked keys they believed were exposed. OpenAI said it worked with OpenCode to restore access and refund its API customers. OpenCode said refunds were underway and that the incident remained ongoing. During the response, AI models the team used for analysis started refusing to work because the malicious code tripped their safety filters.
What the AI did
Attackers broke into OpenCode Console, where some users stored API keys for AI services. Users then reported unauthorized charges on their AI provider accounts. OpenCode linked the breach to a large-scale distillation attack, a process that needs a high volume of AI model outputs, but critics said that use is unproven. OpenCode has not detailed the full extent of any misuse. During the response, AI models the team used for analysis started refusing to work because the malicious code set off their safety filters.
First reported October 19, 2026 · Added to the register October 31, 2026 · 1 source
- Unauthorized charges reported
- Hundreds of dollars per account; a few above $1,000
- Deployer
- OpenCode (OpenCode Console)
- Affected
- OpenCode Console users who stored AI API keys
- When it happened
- Not stated in the sources
- First reported
- October 19, 2026
What this means for you
Could this affect you?
If you stored AI provider API keys in OpenCode Console. OpenCode said 1.4% of OpenCode Console users were affected and that it had notified them by email. The exposed keys were ones users kept in Console workspaces. Any organisation that lets a third-party AI tool hold its AI provider keys faces a similar risk.
What to check
- Revoke and replace your API keys directly with each AI provider.
- Set spending alerts and limits on your AI provider accounts.
- Avoid storing AI provider API keys in third-party platforms where possible.
- Plan incident-response tools that will not be blocked by AI model safety filters.
Areas of your AI programme this touches
Every fact and its source (7)
- RefundsOpenAI to refund API customers for credits used in the attack“OpenAI said it worked with OpenCode to restore access and refund its API customers for credits used in the attack”[1]
- Defensive AI refusalsAI models refused to analyze malicious code due to safety filters“started refusing to work when the malicious code they were asked to examine activated safety filters”[1]
- Attack durationAttackers tried to break in nonstop for 48 hours“attackers had been trying to break into its systems nonstop for 48 hours”[1]
- Advice to usersRevoke and replace keys with each provider“It has told affected users to revoke and replace their keys directly with each provider.”[1]
- StatusIncident ongoing“The company said the incident remains ongoing.”[1]
- Share of users affected1.4% of OpenCode Console users“impacted 1.4% of OpenCode Console users”[1]
- Provider responseAnthropic and Google blocked exposed API keys“Anthropic and Google both blocked the API keys they believed were exposed”[1]
Sources
- Hackers hit AI coding tool OpenCode, running up charges on users' AI accountstechcrunch.com · October 19, 2026
How this record is classified. Severity S (4/5): real harm to one organisation, data exposed, or a containment failure. OECD level: incident, an event in which an AI system led to actual harm. Evidence: Confirmed, meaning a company, official or court statement.
The facts in At a glance and in Every fact and its source are quoted from the sources listed. The summary, What the AI did and What this means for you are written from those sources and checked against them automatically before publication. Records reflect what has been disclosed, not everything that has happened. Incidents are found through news feeds and the GDELT Project.
