OpenCode breach exposes API keys, drives unauthorized AI charges
A security breach at OpenCode is affecting a small share of users of its online Console platform as attackers exploit exposed API keys to generate unauthorized charges across AI accounts. The incident is also intensifying scrutiny of how safety restrictions on commercial AI models can hamper live cyber defense during active attacks.
Highlights
- OpenCode confirms a breach of its older Console system exposed API keys for 1.4% of users, resulting in unauthorized AI service charges exceeding $1,000 for some.
- Anthropic and Google proactively block compromised API keys while OpenAI collaborates with OpenCode to restore lost access and refund affected API credits, as refunds proceed.
- AI safety filters hampered rapid breach investigation, prompting OpenCode to use OpenAI's Daybreak Blue program for less restrictive analysis amid rising AI-driven cyberattacks.
Console breach response and exposed keys
As first reported by TechCrunch, OpenCode says attackers broke into an older system overnight and affected 1.4% of users of OpenCode Console, the online platform where some users store API keys used to access AI services.The company says it notified impacted users by email on Saturday and that users who did not receive a message were not affected. Developers begin posting spending alerts and unauthorized charges on Reddit and X, with some reporting bills in the hundreds of dollars and a few describing totals above $1,000.
Anthropic and Google block API keys they believe are exposed, while OpenAI says it is working with OpenCode to restore access and refund its API customers for credits used in the attack. OpenCode says refunds for unauthorized charges are underway and advises affected users to revoke and replace their keys directly with each provider.
Co-founder Dax Raad says the exposed keys are limited to OpenCode Console workspaces and that the open-source app and command-line tool are not affected. OpenCode has not detailed how attackers accessed the older system, how the keys were stored, or the full extent of any misuse, and says the incident remains ongoing.
Our earlier article on the Bank of England’s push for “bare metal” recovery planning explained why regulators want banks to be able to restore critical services even if primary systems are compromised. We noted Sarah Breeden’s warning that advances in AI are increasing the scale and complexity of cyber attacks, prompting a stronger focus on end-to-end resilience and fallback arrangements across the financial system.
Latest Company News News
-
Afghanistan
-
Albania
-
Algeria
-
Angola
-
Argentina
-
Armenia
-
Australia
-
Austria
-
Azerbaijan
-
Bahamas
-
Bahrain
-
Bangladesh
-
Belarus
-
Belgium
-
Bolivia
-
Botswana
-
Brazil
-
Brunei
-
Bulgaria
-
Cambodia
-
Cameroon
-
Canada
-
Chile
-
China
-
Colombia
-
Congo
-
Costa Rica
-
Cote d'Ivoire
-
Croatia
-
Cuba
-
Cyprus
-
Czechia
-
DR Congo
-
Denmark
-
Dominican Republic
-
Ecuador
-
Egypt
-
El Salvador
-
Estonia
-
Eswatini
-
Ethiopia
-
Finland
-
France
-
Georgia
-
Germany
-
Ghana
-
Greece
-
Haiti
-
Hong Kong
-
Hungary
-
India
-
Indonesia
-
Iran, Islamic republic
-
Iraq
-
Ireland
-
Israel
-
Italy
-
Jamaica
-
Japan
-
Jordan
-
Kazakhstan
-
Kenya
-
Korea
-
Kuwait
-
Kyrgyzstan
-
Laos
-
Latvia
-
Lebanon
-
Lesotho
-
Libya
-
Lithuania
-
Luxembourg
-
Madagascar
-
Malaysia
-
Malta
-
Mauritius
-
Mexico
-
Moldova
-
Mongolia
-
Montenegro
-
Morocco
-
Mozambique
-
Myanmar
-
Namibia
-
Nepal
-
Netherlands
-
New Zealand
-
Nigeria
-
North Macedonia
-
Norway
-
Oman
-
Pakistan
-
Palestine
-
Panama
-
Papua New Guinea
-
Paraguay
-
Peru
-
Philippines
-
Poland
-
Portugal
-
Puerto Rico
-
Qatar
-
Reunion
-
Romania
-
Rwanda
-
Saudi Arabia
-
Serbia
-
Singapore
-
Slovakia
-
Slovenia
-
Somalia
-
South Africa
-
Spain
-
Sri Lanka
-
Sweden
-
Switzerland
-
Syria
-
Taiwan
-
Tajikistan
-
Tanzania
-
Thailand
-
Trinidad and Tobago
-
Tunisia
-
Turkey
-
UAE
-
Uganda
-
Ukraine
-
United Kingdom
-
United States
-
Uruguay
-
Uzbekistan
-
Venezuela
-
Vietnam
-
Yemen
-
Zambia
-
Zimbabwe
- Forex
- Crypto
