Problem Solutions
Hackers Ran Up Charges on OpenCode Users' AI Accounts — Revoke and Replace Your Keys
Overnight on October 16, attackers broke into OpenCode's hosted Console system and got hold of AI provider keys stored in some users' workspaces. Within hours, developers were posting spending alerts on Reddit and X: their OpenAI, Anthropic and Google accounts were all firing at once. Some reported charges in the hundreds of dollars; a few described totals above $1,000, and one user put the figure at $1,700. OpenCode notified affected users by email on October 17 and said refunds were underway. The incident is a follow-up to the breach we covered on October 19 — this article covers the money, the attack itself, and what the providers did — but the practical advice has not changed: if you were affected, revoke and replace your keys at the provider, because changing your OpenCode password does nothing to a key that is already out.
What happened: a legacy system, a nonstop attack
OpenCode is an open-source AI coding tool, an alternative to Claude Code and Cursor, and its hosted Console is where some users store the API keys they use to access AI services. The attackers got into an older system connected to Console — one the company was already in the process of decommissioning — and, according to OpenCode, affected 1.4% of Console users. The company described the incident as a "large-scale distillation attack": distillation is the technique of training a smaller model on the outputs of a larger one, and done at scale with stolen access, it becomes a way to burn through someone else's paid quota to pull answers out of frontier models. That framing is disputed. OpenCode has not publicly explained how the attackers got into the system, and skeptics have called the distillation label an overstretch, arguing that what is proven is a straightforward breach whose use for distillation remains unproven. What is not disputed is the spending: a flood of API calls disguised as normal developer activity, running up real bills on real accounts. Co-founder Dax Raad said on X that the attackers had been trying to break in nonstop for 48 hours, and later added that the team basically needed agents going 24/7 because that is what the attackers had.
The strangest detail: the models refused to help the defenders
During the attack, the OpenCode team put AI models to work to see what the intruders were up to — and the models were some help until the malicious code under review set off the providers' safety filters, at which point they refused to continue. For a small team in the middle of an incident, that is no minor matter: modern attacks churn out vast amounts of logs and code, and AI is one of the few ways a handful of engineers can stay on top of it. A model that cannot tell a defender studying malware from an attacker writing it will, by design, simply say no. Things improved once OpenCode was approved for OpenAI's Daybreak program, which lets vetted defenders use models more willing to do defensive security work. Raad wrote on X that the change made a real difference to the investigation. The same week, the attack spilled into OpenCode's support channel: one user who opened Discord found it flooded not with support queries but with nonsense messages — "Yo," "Delete telegram" — popping up every two seconds, burying his post about the fraudulent charges. Whether that flood was part of the attack or opportunistic noise is unclear; either way, it made getting help harder at the worst moment.
What the providers did
The three providers moved differently, and the differences matter if you are waiting on money. Anthropic and Google both blocked the API keys they believed were exposed. OpenAI said it worked with OpenCode to restore access and refund its API customers for credits used in the attack. OpenCode says refunds for unauthorized charges are underway, and has asked affected users to go directly to each provider to revoke and replace their keys, and to check their accounts for use they did not recognize. One thing the company emphasized throughout: the breach involved Console, not its open-source coding app or its command-line tool. Co-founder Dax Raad clarified on X that the exposed keys were confined to Console workspaces, and that the standalone app's keys never come to the company. If you received no notification email, OpenCode says you were not affected — but the users who were affected learned about it from their billing alerts first, so checking your provider dashboards yourself is still worth doing.
What to do now, in order
First, check every provider you had linked to OpenCode Console: OpenAI, Anthropic, Google, or others. Look for usage you do not recognize, and for spend alerts you may have dismissed as a billing glitch. Second, rotate each key at the provider's own dashboard, in this order: create the new key first, deploy it everywhere the old one is used and confirm things work, then delete the old key. Deleting first and deploying second is how you lock yourself out of your own tooling in the middle of an incident. Third, set spending caps at the provider level, so one compromised tool cannot translate into unlimited usage against every account you own. Fourth, switch to per-project keys where your provider supports them, so a single leaked key has a bounded blast radius. And fifth, treat any AI coding platform's hosted dashboard the way you treat a production database password store: the keys it holds are a line of credit against someone else's wallet, usable instantly, from anywhere, until someone notices the bill. The pattern across this year is the same in every case: these tools are built to hold powerful, spend-capable credentials so they can act autonomously, and that is precisely what makes a single breach so expensive.