Breach of older OpenCode system exposed keys and drove unauthorised charges

Hackers breached an older system connected to OpenCode Console, exposing some users’ stored AI service keys and triggering unauthorised usage charges. The incident affected 1.4% of Console users; OpenCode said it notified those affected, while stressing that its open-source app and command-line tool were not compromised.

Some users reported charges of hundreds of dollars, with a few exceeding $1,000. Anthropic and Google blocked keys they believed were exposed, and OpenAI worked with OpenCode to restore access and refund affected API customers; OpenCode said refunds were underway. The company described the breach as linked to a large-scale “distillation” attack, though some questioned whether that use was established. OpenCode also said AI safety filters initially hindered its defensive investigation, until it gained access to OpenAI’s Daybreak Blue programme.