Hackers stole OpenCode users' AI keys — some bills topped $1,000

OpenCode, an open-source AI coding agent gaining ground as an alternative to Claude Code and Cursor, said attackers broke into an older system overnight and affected 1.4% of users of OpenCode Console, its online platform where some users store the API keys they use to access AI services from OpenAI, Anthropic and Google.

Developers began posting spending alerts on Reddit and X, reporting unauthorised charges in the hundreds of dollars, with a few totals above $1,000. OpenCode said it emailed all affected users, and that users who received no email were not impacted. Anthropic and Google blocked keys they believed were exposed, OpenAI said it worked with OpenCode to restore access and refund credits used in the attack, and OpenCode said refunds were underway and advised users to revoke and replace their keys.