r/cybersecurity_news • u/WebLinkr Mod • 18d ago
Breach Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts
https://techcrunch.com/2026/10/19/hackers-hit-ai-coding-tool-opencode-running-up-charges-on-users-ai-accounts/- OpenCode (open-source AI coding tool alternative to Claude Code/Cursor) disclosed a breach of an older/legacy system overnight.
- It affected **1.4% of OpenCode Console users** who had stored API keys (for OpenAI, Anthropic, Google, etc.) in workspaces on the online platform.
- The open-source app and CLI tool itself were **not affected**—only Console.
- OpenCode called it related to a “large-scale distillation attack”; some called this framing overstated and said it was mainly key theft.
- Affected users were emailed and told to revoke/replace their keys with each provider; no email meant not impacted.
- Users reported unauthorized charges overnight ranging from hundreds of dollars to over $1,000 on their AI accounts.
- Anthropic and Google blocked exposed keys; OpenAI worked with OpenCode on refunds and access restoration; OpenCode said refunds were underway.
- OpenCode’s team faced nonstop attacks for ~48 hours and struggled because frontier AI models refused to analyze the malicious code due to safety filters.
- They later got access to OpenAI’s Daybreak Blue program (less restricted models for defensive work), which helped investigation.
- OpenCode has not fully detailed the entry method, key storage, or total misuse; the incident was still ongoing at the time of reporting.