OpenCode Console breached, leaked API keys rack up unauthorized AI charges

Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts

OpenCode says an intrusion into its legacy system hit 1.4% of OpenCode Console users, and leaked API keys led to unauthorized charges on AI accounts. Some users report bills above $1,000, and refunds are being processed. The open-source app and command-line tool were not affected, and affected users have been told to revoke and replace their keys.

Why it matters: The team's attack-code analysis was blocked by a model's safety filter, and switching to a model that refuses fewer defensive requests improved the investigation.