OpenCode, an open-source AI coding agent, reported a security breach on its online platform, OpenCode Console. The incident, which occurred overnight, affected 1.4% of the platform's users. Attackers gained access to an older system, exposing API keys stored by users to access third-party AI services.
Users reported unauthorized charges on their accounts, with some totals exceeding $1,000. In response, Anthropic and Google blocked the compromised API keys. OpenAI collaborated with OpenCode to restore access and is processing refunds for affected customers. OpenCode confirmed that refunds for unauthorized charges are currently underway.
Co-founder Dax Raad stated that the breach was limited to the Console platform, while the open-source application and command-line tool remained unaffected. The company reported that attackers attempted to breach its systems continuously for 48 hours. The team utilized AI models for defense, though some initially triggered safety filters.
The company later gained access to OpenAI’s Daybreak Blue program, which provides models with fewer safety restrictions for security analysis. OpenCode has advised all affected users to revoke and replace their API keys. The investigation into the breach remains ongoing, and the company has not yet disclosed the specific method used by the attackers.
