Security Breach and Unauthorized Charges in AI Coding Tool OpenCode
A security breach on the OpenCode Console platform led to the compromise of users' API keys and unauthorized spending amounting to hundreds of dollars on OpenAI, Anthropic, and Google accounts.
An attack on a legacy system of the open-source AI coding tool OpenCode affected 1.4% of OpenCode Console users. Attackers used API keys stored on the platform to make unauthorized charges from users' AI accounts.
OpenCode is drawing attention as an open-source AI coding agent rapidly spreading among developers. According to a statement by the company, attackers who breached a legacy system during the night affected 1.4% of users on OpenCode Console, the online platform where API keys are stored. The company reported that all affected users were notified via email in the morning, and those who did not receive an email were not affected.
It was revealed that attackers reflected unauthorized charges onto accounts at providers such as OpenAI, Anthropic, and Google using the keys they seized. Some developers shared on social media platforms that they received spending alerts of hundreds or even over a thousand dollars. While Anthropic and Google blocked the API keys at risk, OpenAI announced it is working with OpenCode to restore access and refund credits used in the attack. OpenCode officials stated that refund processes have been initiated for unauthorized expenses.
Sources
- techcrunch.com · Link