OpenCode, an open-source AI coding agent, told some users that attackers obtained the API keys they had stored on its hosted OpenCode Console platform, BleepingComputer and TechCrunch reported Monday. API keys are the secret credentials that let software call a paid AI service and bill the key owner's account. Affected developers reported unauthorized charges on their OpenAI, Anthropic and Google accounts overnight, showing how a breach at one outside tool can turn directly into spending and abuse across several AI providers.
What Happened
OpenCode said Saturday that attackers had broken into an older system overnight, according to TechCrunch, and that the breach affected 1.4% of OpenCode Console users, limited to those who had linked external AI providers. The project has not said how many people use Console. Infosecurity Magazine reported that the notice described access to a legacy system the company was in the process of decommissioning.
OpenCode's email to affected users gave Oct. 17 at 00:30 UTC, or 8:30 p.m. Eastern time Oct. 16, as the earliest possible exposure and said no other data appears to have been exposed, BleepingComputer reported. OpenCode has not explained how the attackers got in or how the keys were stored, and it said the incident was still ongoing, TechCrunch reported. It told affected users to revoke their keys and issue new ones directly with each provider, and said users who received no email were not affected.
Developers reported unauthorized charges ranging from several hundred dollars to more than $1,700 overnight, according to BleepingComputer, and some said Google suspended their projects for activity consistent with hijacked resources. TechCrunch reported that Anthropic and Google blocked keys they believed were exposed, while OpenAI said it worked with OpenCode to restore access and refund credits used in the attack. OpenCode said refunds are underway.
Co-founder Dax Raad said the exposure was confined to Console and that OpenCode's open-source app and command-line tool were not affected, TechCrunch reported. He said attackers had tried to break into the company's systems for 48 hours; BleepingComputer reported that he said they used AI agents.
The Distillation Claim
OpenCode described the incident as a "large-scale distillation attack," TechCrunch reported. Distillation means training a cheaper AI model on a large volume of answers from a stronger one, which requires heavy paid usage that stolen keys could cover. TechCrunch noted that leaked keys could help users in countries with restricted access to American models generate that volume. It also reported that some skeptics consider the framing a stretch, arguing that this was a straightforward breach and that use of the keys for distillation is unproven. OpenCode has not named a suspect. Leading AI labs have separately accused rival developers of copying their models this way.
Raad also said the AI models his team used to analyze the attack stopped helping once the malicious code tripped their safety filters, and that the investigation improved after OpenCode was approved for OpenAI's Daybreak program, which gives vetted defenders models less likely to refuse security work, both outlets reported. David Sacks, co-chair of the President's Council of Advisors on Science and Technology, cited this incident and an earlier one at Hugging Face in a post on X, writing that "The guardrails backfired," according to TechCrunch.
Why It Matters
The lesson for executives reaches beyond one open-source project. Developer tools increasingly store keys for several AI providers so teams can share access from one place. That convenience creates a single target: whoever breaches the tool can spend against every linked account, and the bill lands on the customer. OpenCode is widely used; Jay V, chief executive of Anomaly, the company that develops it, claimed in July that it had about 13 million monthly users, Infosecurity Magazine reported.
Boards and technology chiefs should know which third-party tools hold their organization's AI keys, whether those keys carry spending limits and narrow permissions, and how quickly they can be revoked. Providers limited the damage here by blocking keys and refunding charges, but that depended on the tool maker alerting them.
What to Watch
OpenCode has not published a post-mortem explaining how attackers entered or how keys were stored. Whether the stolen keys were actually used for distillation, and by whom, remains unconfirmed. Also watch whether refunds cover all affected users and whether AI providers tighten rules for keys held by outside platforms.
