OpenCode, the open source AI coding agent that has become a popular alternative to Claude Code and Cursor, said Saturday that attackers broke into an older part of its online platform overnight. The breach affected 1.4% of users of OpenCode Console, the web platform where some users store the API keys they use to reach AI services, according to the company. All affected users were notified by email on Saturday morning, and OpenCode said those who did not receive an email were not impacted.
The incident matters because the stolen keys were not just a privacy problem. Developers began posting spending alerts and unauthorized charges on Reddit and X, with some reporting hundreds of dollars and a few describing totals above $1,000. OpenCode said refunds for unauthorized charges are underway.
What was exposed in the OpenCode Console breach
The exposed keys were confined to Console, where some users had stored them in workspaces, according to co-founder Dax Raad. He wrote on X that the open source app and command-line tool were not affected, adding that those keys never come to the company.
OpenCode has told affected users to revoke and replace their keys directly with each AI provider. The company has not detailed how attackers gained access to the older system, how the keys were stored, or the full extent of any misuse, and it said the incident remains ongoing.
- Attackers broke into an older OpenCode Console system overnight.
- 1.4% of OpenCode Console users were affected and notified by email.
- Some users saw unauthorized AI charges in the hundreds of dollars; a few reported more than $1,000.
