OpenCode Breach Exposed API Keys, Triggered Rogue AI Charges

According to BleepingComputer, the open-source AI coding project OpenCode has notified a portion of its users that their stored API keys were exposed in a security breach. Some of those users reported unauthorized charges running overnight, with one case topping $1,700.

OpenCode has acted quickly and said what happened, which is the part worth tracking here. The project maintainer confirmed the breach affected 1.4% of OpenCode Console users, all of whom had linked external AI providers such as Anthropic, OpenAI, and Google to their accounts. Every one of them was emailed the same morning the breach was confirmed. Anyone who did not receive an email was not affected, because the exposure was limited to that linked-provider subset.

What happened and what OpenCode did

The incident was a distillation attack, a technique normally used to train smaller AI models on the outputs of larger ones. At scale and without authorization, that same technique lets an attacker drain value from someone else's AI access. OpenCode co-founder Dax Raad said attackers had been targeting the company's systems for at least 48 hours using AI agents of their own. Investigating the attack was slowed because the AI models OpenCode was using to look into it began refusing requests, triggered by their own built-in security safeguards.

The situation stabilized once OpenCode began using OpenAI's Daybreak AI cybersecurity model for defensive work, approved for that use on Saturday. The sequence shows something specific: OpenCode did not catch this through its own monitoring fast enough to stop the charges, but it moved from breach to containment to user notification inside a short window, and it brought in outside AI defenses rather than trying to handle an AI-scale attack with ordinary tools.

The email sent to affected users states that the earliest possible exposure of keys was October 17, 2026, 00:30 UTC, and that no data appears to have been exposed beyond the keys themselves. OpenCode is working with Google, OpenAI, and Anthropic on the incident, though it has not shared further detail publicly. Some users reported that Google suspended their projects after detecting activity it described as consistent with hijacked resources, which is itself a form of protection working as intended, catching abuse even where the root cause sat elsewhere.

What this changes for users

OpenCode's message to affected users raises the possibility of reimbursement for the unauthorized charges. That matters for anyone who linked a provider key to the console and is now looking at a bill they did not expect. It also means the response did not stop at notification: there is a path, even if details are still limited, toward making affected users whole.

BleepingComputer contacted OpenCode for more detail and had not heard back as of publication.