Hackers breach OpenCode Console and expose some users’ API keys

OpenCode said attackers broke into an older system overnight, exposing some users’ API keys stored in OpenCode Console, its online platform. The company said 1.4% of Console users were affected and that it notified them by email. Users who did not receive an email were not affected, it said.

Developers reported spending alerts and unauthorized charges on Reddit and X. Some described charges in the hundreds of dollars on individual accounts, while a few reported totals above $1,000. Anthropic and Google blocked keys they believed were exposed. OpenAI said it worked with OpenCode to restore access and refund API customers for credits used in the attack. OpenCode said refunds for unauthorized charges were underway.

Co-founder Dax Raad said the exposed keys were limited to Console; the open-source app and command-line tool were not affected. OpenCode has not detailed how attackers accessed the older system, how keys were stored, or the full extent of any misuse. It said the incident was ongoing and told affected users to revoke and replace their keys with each provider.

Raad said attackers had tried to break into OpenCode’s systems nonstop for 48 hours. He said AI models used to analyze the incident initially helped, then refused to examine malicious code after safety filters activated. OpenCode later received access to OpenAI’s Daybreak Blue program, which provides vetted users with models less likely to refuse defensive security requests. Raad said that access improved the team’s investigation.