Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts

OpenCode, the open-source coding agent that’s been winning over developers as a rival to Claude Code and Cursor, said an attacker got into an older system overnight and reached 1.4% of users on its OpenCode Console platform. That’s where some people keep API keys, the digital credentials they use to tap AI services. The company said it emailed everyone affected on Saturday morning; if a user didn’t get one, OpenCode said they were not impacted.

The damage showed up fast. Developers started posting alerts and unauthorized spending on Reddit and X, with some saying charges hit the hundreds of dollars and a few putting the total above $1,000. Anthropic and Google blocked the keys they believed had been exposed. OpenAI said it worked with OpenCode to restore access and refund customers for credits used during the attack, while OpenCode said refunds for unauthorized charges are already underway.

OpenCode was careful to draw a line between the Console and the open-source app itself. Co-founder Dax Raad said the keys never reached OpenCode and that the app and command-line tool were not affected. The exposed keys were limited to Console workspaces, according to the company. But OpenCode also said the incident is still ongoing, and it has not explained how the attackers got in, how the keys were stored, or how widely they were misused.

What made the weekend stand out was the defense problem. Raad said attackers had been trying to break in for 48 hours, forcing the team to keep AI defensive agents running nonstop. Some models helped for a while, then started refusing to inspect the malicious code because safety filters kicked in. OpenCode later got access to OpenAI’s Daybreak Blue program, which gives vetted users models that are less likely to refuse defensive work, and Raad said that improved the investigation.

That complaint has now become a pattern. Hugging Face raised the same issue in July after commercial models blocked its attempt to analyze logs from an intrusion by autonomous AI agents. Security researchers have been saying the same thing: the guardrails can make the defender trip over the same prompts the attacker uses. And with AI-enabled attacks piling up — from CrowdStrike’s report this month to India’s warning last week — the industry is learning that “safe by default” can be a lovely slogan right up until the breach starts.