OpenCode breach may have exposed users’ AI provider API keys
An intruder accessed a legacy system on October 16, potentially exposing OpenAI, Anthropic and Google keys saved in the optional hosted Console service, according to The Hacker News. OpenCode notified a small number of affected users, BleepingComputer reported, while TechCrunch reported that attackers used stolen keys to run up charges on users’ accounts.
- TechCrunch reported that AI tools refused to examine the malicious code.
Covered by 4 publishers within 30 hours of the first report.
- The Hacker News: OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys
- Latest TechCrunch: Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts
Reporting4
The Hacker News OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys · info@thehackernews.com (The Hacker News)
BleepingComputer OpenCode hack exposes API keys amid AI distillation attacks · Bill Toulas
TechCrunch Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts · Aditya Mehta
Implicator.ai DeepSeek barred at US civilian agencies; hackers run up OpenCode users’ AI bills · Marcus Schuler