Hackers breached AI coding tool OpenCode and ran up $1,000 API bills w

Hackers breached AI coding tool OpenCode and ran up $1,000 API bills while AI safety filters blocked defenders for 48 hours

Open-source coding agent OpenCode disclosed that attackers broke into an older server on its online platform, OpenCode Console, exposing stored API keys for 1.4% of its users. Several developers reported unauthorized OpenAI, Anthropic, and Google AI charges exceeding $1,000.

Anthropic and Google blocked the leaked keys while OpenAI refunded affected API credits. Co-founder Dax Raad confirmed the open-source CLI tool was unaffected, though attackers hammered OpenCode systems nonstop for 48 hours.

When OpenCode engineers tried using commercial AI models to analyze the exploit payloads, safety filters blocked their defensive requests until the team gained access to OpenAI's Daybreak Blue program. David Sacks noted that Hugging Face hit the same guardrail wall in July.