# Attackers breach OpenCode Console, running up charges on users' AI accounts

published: 2026-10-20T11:05:28.567Z
topic: infrastructure
breaking: true
source: https://techcrunch.com/2026/10/19/hackers-hit-ai-coding-tool-opencode-running-up-charges-on-users-ai-accounts/
url: https://aiagentnews.io/stories/attackers-breach-opencode-console-running-up-charges-on-users-ai-accounts

OpenCode, an open source AI coding agent, said attackers broke into an older system overnight and affected 1.4% of users of its OpenCode Console platform, where some store API keys. Developers reported unauthorized charges on their OpenAI, Anthropic and Google AI accounts, and the company says refunds are underway.

OpenCode said the attackers broke into an older system overnight, affecting 1.4% of OpenCode Console users. The company notified affected users by email and said users who did not receive an email were not impacted. It did not say how the attack occurred, though it described it as a large-scale distillation attack, a claim some skeptics said remained unproven.

Developers posted spending alerts and unauthorized charges on Reddit and X, with some reporting totals above $1,000. Anthropic and Google blocked the API keys they believed were exposed, and OpenAI said it worked with OpenCode to restore access and refund API customers for credits used in the attack. Co-founder Dax Raad said the open source app and command-line tool were not affected.

OpenCode said the incident remains ongoing and has not detailed how attackers got in, how keys were stored, or the full extent of the misuse. Raad said the team's AI defensive tools refused to analyze the malicious code once safety filters triggered, until OpenCode gained access to OpenAI's Daybreak Blue program for vetted users.

## Why it matters if you build agents

If you store provider API keys in a hosted console or workspace, rotate them now and check your spending alerts, since the exposed keys were the route to the unauthorized charges.

The episode shows that safety filters on frontier models can block incident response work, so teams should plan for vetted access programs before an attack happens.