A developer opens a billing alert on a Saturday morning and sees hundreds of dollars charged to an AI account he barely touched. Within hours, others report the same thing: charges from OpenAI, Anthropic and Google that none of them made.
The common thread is OpenCode, a popular open-source AI coding agent. The company says attackers broke into its online platform, OpenCode Console, overnight on Friday, and that the keys some users had stored there may have been exposed. TechCrunch reported the incident on October 19.
READ ALSO: Anthropic's AI Sent Police a Fake Murder Tip During a Test
OpenCode says about 1.4% of Console users were affected. If you stored an AI provider key there, revoke it at the provider, not just inside OpenCode.
What happened at OpenCode
OpenCode has two parts. The open-source app and command-line tool run on your own machine. The Console is a hosted service where users can store API keys, the credentials that let a program use paid AI models. According to OpenCode's own announcement on X, the break-in hit the Console, and the company emailed affected users on Saturday morning. Users who got no email were not affected.
Co-founder Dax Raad stressed that the open-source tool itself was not compromised, because keys never pass through OpenCode when you use it locally. The problem was limited to people who had saved a provider key in the hosted Console.
The Hacker News reports that keys for OpenAI, Anthropic and Google may have been exposed, and that OpenCode has framed it as an attack on an older system. TechCrunch adds that the company called it a large-scale distillation attack, a term for copying a model's behavior by sending it many requests. OpenCode has not yet explained how the attackers got in or how the keys were stored, so the distillation claim is the company's description, not something independent researchers have confirmed.
The charges and the response
Developers posted spending alerts showing unexpected usage across the three providers. Some charges ran to hundreds of dollars, and a few passed $1,000, according to TechCrunch's reporting.
The providers moved quickly. Anthropic and Google blocked the keys they believed were exposed. OpenAI worked with OpenCode to restore access and said it would refund credits used in the attack, and OpenCode says refunds are underway. The incident is still described as ongoing.
Raad said attackers had hammered the system for about 48 hours. He added that the team ran AI agents to defend it around the clock, but that commercial models eventually refused to analyze the malicious code once it tripped their safety filters. OpenCode later gained access to an OpenAI program built for vetted security work, which he said helped the investigation. That detail has fed a wider argument about whether safety guardrails slow down defenders as much as attackers.
READ ALSO: Google's New Gemini Agent Gets Its Own Work Email and Runs Claude Too
What you should do now
If you have ever used OpenCode Console, treat your keys as burned, even if you got no email. The Hacker News recommends these steps:
- Revoke the key in the OpenAI, Anthropic or Google dashboard and create a new one. Deleting it from the Console does not cancel it.
- Update every app, script and tool that used the old key.
- Check each provider's billing page for unfamiliar usage going back to at least October 16.
- Set a monthly spending cap on every API account you own.
What this means
The lesson reaches well beyond one coding tool. AI agents work best when you hand them keys with real spending power, and every place those keys are stored is a target. A leaked password costs you access. A leaked AI key costs you money, fast, because the attacker can run expensive models on your bill.
For teams, the practical rules are simple. Keep keys on your own machine or in a proper secrets manager, give each tool its own key, and cap spending so a breach hits a ceiling. OpenCode's open-source tool was not the weak point here, which is a reminder that the risk often sits in the convenience services built around a tool, not the tool itself.
Many details are still open, including the entry point, the timeline and the total losses. We will update this story as OpenCode publishes more.
The breach hit a hosted service, not the open-source tool. Revoke any key you stored there, cap your AI spending and keep keys out of third-party dashboards where you can.
