wire / 2026-10-17-9e2d
OpenCode breach exposes users' OpenAI, Anthropic and Google API keys, leading to unauthorized charges
Someone else ran expensive AI queries and the developers got the invoice. That is one way to experience usage-based pricing.
The facts
A legacy system breach at OpenCode exposed API keys for OpenAI, Anthropic, and Google, affecting 1.4% of Console users. Attackers used stolen keys to run expensive AI queries, resulting in unauthorized charges and financial losses for developers. OpenCode urged affected users to revoke and replace credentials immediately.