OpenCode, an open-source AI coding tool, has confirmed a security incident that may have exposed third-party API keys stored in user workspaces. The company said about 1.4% of OpenCode Console users were affected.
The issue surfaced after developers began posting unusual bills online. Several said token usage surged within hours while they were away, draining account balances to zero and, in some cases, triggering automatic top-ups. One user said an Anthropic account was charged $400. Another reported losses of more than $1,700. There were also claims that Google Cloud API bills jumped by more than $1,000 without authorization.
As more cases appeared, OpenCode said on X that it had suffered a security flaw linked to a large-scale distillation attack the night before. In an emergency email to users, the company said the problem came from an older legacy system that was already being prepared for shutdown. After reviewing the incident, OpenCode said the system had been compromised before it was fully retired, and that third-party API credentials saved in workspaces, including keys for OpenAI and Anthropic, may have been exposed.
OpenCode says it is working with model providers
OpenCode said it sent warning emails to developers overnight and is working with Anthropic, OpenAI and Google on the response. The company told affected users to revoke and rotate API keys immediately, update application settings, and review recent usage logs and billing records.
Lydia Hallie of Anthropic responded publicly, saying, 「All Claude API keys suspected of exposure have now been forcibly revoked.」
Co-founder says his own account was hit
Shortly after the company’s statement, OpenCode co-founder Dax Raad said on X that his own personal account was also under attack. He wrote, 「Even my own personal account is now being attacked. This wave of AI-automated hacking opens up a whole new world.」
That comment suggested the incident was not limited to a small set of ordinary users. Members of the founding team were also affected.
Stolen keys were used to query top-tier models
According to the report, the attackers were not described as reselling the keys or trying to steal private chat records. Instead, they used the stolen credentials to consume victims’ balances and make heavy calls to top-tier models. The report said those outputs could be used to generate chain-of-thought, or CoT, and code data for training other models.
The article also said that buying OpenAI and Claude API access directly to generate this kind of training data could cost millions or even tens of millions of dollars. Because major model providers generally prohibit using their outputs for training and have risk controls in place, the attackers were described as shifting to third-party AI tool aggregators such as OpenCode to obtain large numbers of real developer API keys at once, pushing the usage costs onto victims.
Changing a password does not invalidate an old API key
In its security notice, OpenCode said users who received the alert should go to the official consoles of the relevant model providers and revoke and replace any potentially exposed API keys. Changing an account password is not a substitute for revoking an API key. Deleting a configuration inside OpenCode or shutting down a local program also does not automatically invalidate credentials that have already leaked.
Users were also told to inspect recent usage and billing records, keep logs of abnormal calls, timestamps and related notices, and contact service providers for investigation and billing review. Applications that still depend on old keys also need to be updated.
OpenCode said the leak affected 1.4% of users’ keys. The share was limited, but the incident highlighted the security risk of storing API credentials with third-party consoles. For developers, once an API key is exposed, usage limits and billing risk can turn into direct losses very quickly.