Hackers Exploit OpenCode API Keys, Triggering Unauthorized Charges
Current overview (not historical)
Hackers launched a large‑scale distillation attack on OpenCode, stealing API keys and causing users to incur unauthorized charges ranging from hundreds to thousands of dollars. The company reported that the breach affected 1.4% of its Console users, noting that those who did not receive a notification email were not impacted. OpenCode clarified that its open‑source application and command‑line tool were not compromised. The incident highlights the vulnerability of cloud‑based AI coding platforms to key‑stealing attacks and the potential for significant financial loss to unsuspecting users. While OpenCode has taken steps to mitigate the breach, the event underscores the need for robust key management and user notification systems in AI services.
Written with AI from the reporting · updated 10/19/2026
Expand the detailed fact route and sources
Story route
A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.
- 1Unclassified fact stationOct 19, 00:00recorded Oct 20, 04:11single sourcerevised
Hackers hit AI coding tool OpenCode, running up charges on u
Read original source ↗ TechCrunch · AIReplay this moment in the explorerEvidence & revisions · 1 source records
- Subject：
- OpenCode
- Action：
- security breach affecting 1.4% of users
- Object：
- users' API keys and AI accounts
- Occurred (fact side)：
- Oct 19, 00:00
- Published (valid side)：
- Oct 20, 03:28
- First seen (known side)：
- Oct 20, 04:11
Fact stationSingle source · one-sided claimRevisedCopy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.
Uncertainty marks flag where to check the sources; they are not proven causation.
Report timeline
Explore every side through dated source reports.
- TechCrunch · AIRelated fact: single sourceSource report revisedOpenCode Console hack exposes API keys, users report unauthorized AI charges
Report first recorded Oct 20, 04:11
OpenCode Console, a platform for managing AI API keys, was breached overnight, affecting 1.4% of users. Attackers exploited leaked keys to run up unauthorized charges on accounts from OpenAI, Anthropic and Google, with some users reporting hundreds or over $1,000 in costs. The incident highlights vulnerabilities in AI model access for users in restricted regions.
Read original source ↗
Event discussion
Reader opinions are hosted on GitHub Discussions; posting requires a GitHub account. Comments are not verified facts.