Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts
- ID
- 37093
- Status
- summarized
- Published
- 20 Oct 2026, 3:28 AM
- Fetched
- 20 Oct 2026, 6:55 AM
- Provider
- TechCrunch
- Category
- technology
- Original URL
- https://techcrunch.com/2026/10/19/hackers-hit-ai-coding-tool-opencode-running-up-charges-on-users-ai-accounts/
- Source URL
- https://techcrunch.com/feed/
Summary
- Score
- 7.5
- Created
- 20 Oct 2026, 6:56 AM
- Tags
- Audience
- developersvibe_codersai_agent_userssaas_founders
What happened
OpenCode said attackers breached an older system overnight and affected 1.4% of OpenCode Console users, where some users store API keys for AI providers. Developers reported spend alerts and unauthorized charges in the hundreds of dollars, with a few above $1,000; Anthropic and Google blocked exposed keys, OpenAI refunded API credits, and OpenCode says refunds are underway. The company called it a "large-scale distillation attack," while skeptics said the distillation use is unproven.
Why it matters
If you use OpenCode Console—or any AI coding agent that stores provider API keys for you—rotate those keys now and set hard spend limits with OpenAI, Anthropic, and Google. The reported charges reached hundreds to over $1,000 per account before providers and OpenCode responded, so storing long-lived provider keys in a third-party console is a concrete risk to decide on, not a hypothetical one.
Discussion angle
What key-handling policy should your team adopt for AI coding agents: bring-your-own short-lived keys, per-provider spend caps, or no third-party key storage—and does OpenCode's 1.4% disclosure and refund process change that choice?