OpenCode breach leaks API keys, runs up charges on user accounts
OpenCode, the open source AI coding agent that’s gained traction as a free alternative to Claude Code and Cursor, has been hit by a breach. Hackers got into part of the platform’s online infrastructure, stole API keys from users, and ran up charges on their connected AI accounts.
What Happened
The attackers accessed a portion of OpenCode’s platform and exfiltrated API keys. With those keys in hand, they used the associated AI services at the victims’ expense. The exact scope of affected accounts has not been reported.
There’s an additional wrinkle: when the OpenCode team turned to AI tools for help analyzing the malicious code, those tools refused to examine it. That refusal slowed the response.
The Operator Takeaway
If you’re running any open source coding agent that connects to paid AI APIs, treat your API keys like passwords. Scope them tightly, rotate them after any suspected exposure, and set hard spend limits at the provider level. A compromised key with no spend cap is a blank check.
OpenCode’s situation is a reminder that open source tooling, even popular tooling, carries platform risk that commercial products don’t always publicize either.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
