Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts

When you build software with AI coding tools, you often plug in private API keys to connect services from OpenAI, Anthropic, or Google. A recent security incident on OpenCode Console showed what can happen when those secrets are exposed. Intruders accessed stored credentials and rapidly generated heavy usage, leaving several builders with surprise bills before the compromised connections were shut down.

According to TechCrunch, the breach led to unauthorized charges on developer accounts before providers intervened to block the leaked credentials. Major AI platforms and the OpenCode team stepped in to help refund charges and restore access, but the situation is a wake-up call for anyone learning to create with AI.

Protecting your credentials is an essential habit. Make sure to set hard spending limits on your AI provider accounts so an unexpected surge never drains your wallet. Whenever possible, keep your keys stored safely on your local device rather than inside cloud dashboards, and generate fresh keys right away if you ever notice strange activity.