OpenCode breach let hackers burn users' AI credits for model theft

OpenCode was supposed to shut down an old system, but hackers used it to break in. They stole API keys and used them to make thousands of dollars' worth of AI requests on other people's accounts. But their main goal was not to steal money.

OpenCode confirmed this week that someone without permission broke into an older version of its Console. This was an online dashboard where some users stored API keys for OpenAI, Anthropic, and Google. These keys allowed the open-source coding tool to use those companies' AI models for users. OpenCode said that 1.4% of Console users were affected. That may sound like a small number, but the damage to some users was serious. One user reported unexpected charges of $281 on their OpenAI key and $168 on their Anthropic key. Another reported more than $700 in charges overnight. A third said the charges were over $1,700.

The attackers were not simply trying to steal money. OpenCode traced their activity to what security researchers call a distillation attack. In this kind of attack, hackers use stolen keys to send huge numbers of requests to AI models and collect their answers. They then use those answers to train their own, cheaper model that copies the original model's behavior. Anthropic has publicly explained how it detects and blocks this exact kind of activity on its own platform. This type of attack is not new. OpenAI has also reported a similar case. In July 2026, it tracked about 16,000 requests across more than 4,000 accounts linked to users associated with Moonshot AI. Those users copied encrypted model outputs from one conversation and asked a separate session to decrypt and write them out, trying to extract hidden reasoning. The OpenCode attack followed the same basic pattern: an old system that was no longer being watched closely, hundreds of stored keys, and a flood of API requests made to look like normal developer activity.

OpenAI, Anthropic, and Google have since canceled the stolen keys, and OpenCode says it is working to refund users for the unauthorized charges. According to the company, the standalone OpenCode app and command-line interface (CLI) tool were not compromised. The security weakness was in the Console, a system the company was already preparing to shut down. This detail is important. The breach did not happen because of a flaw in the AI agent's thinking or a clever instruction hidden in a code comment. It happened because an old computer system kept active access keys for longer than it should have.

OpenCode is not the only example of this problem in 2026. Security researchers have separately reported command injection and cross-site scripting flaws in OpenCode itself. These were fixed in versions 1.0.216 and 1.1.10. Similar incidents have also affected other AI coding tools. For example, prompt injection flaws allowed attackers to steal API keys and access tokens from Claude Code, Codex CLI, and other agents through malicious titles and comments in GitHub pull requests. The same problem appears in almost all these cases: these tools need powerful credentials that let them spend money and perform tasks on their own. That power also makes a single security breach very costly. A stolen password gives someone access to an account. A stolen Anthropic or OpenAI API key lets someone spend money from another person's account right away, from anywhere, until the owner notices the charges.

For company founders, the worrying part is that many teams adopting AI coding tools are focused on working faster, not on what could happen if an access key gets stolen. Keys are pasted into dashboards, shared across several tools, and left without spending limits because nobody expects the dashboard itself to be the weak point. The OpenCode incident shows that the problem does not have to be in the clever AI technology. It can be in the ordinary online service that supports it.

Teams can take some simple steps to reduce this risk, even though many do not. Anthropic and OpenAI both offer spending limits for individual API keys. Giving each tool or connection its own key with limited permissions, instead of sharing one key across everything, also means that a single stolen key can cause less damage. OpenAI's strict spending limits work at the organization or project level. When a limit is reached, the system returns a 429 error, which means it is refusing more requests. However, these limits do not take effect instantly, so a determined attacker may still spend a little more money after the limit is reached but before the system stops the requests. Even so, these limits help. If the user who lost $1,700 overnight had set a project spending limit at a much lower amount, the attack could have stopped within minutes instead of continuing for hours.

None of this means that all AI coding agents should be treated as untrustworthy. It means the access keys behind them should be handled like company credit cards: give each key one specific job, set a spending limit low enough that unexpected charges will be noticed, and check the keys using a system other than one you forgot was still running.