OpenCode breach exposes users' OpenAI, Anthropic and Google API keys, leading to unauthorized charges
2026-10-17 | incident | economic
Our take
Someone else ran expensive AI queries and the developers got the invoice. That is one way to experience usage-based pricing.
The facts
A legacy system breach at OpenCode exposed API keys for OpenAI, Anthropic, and Google, affecting 1.4% of Console users. Attackers used stolen keys to run expensive AI queries, resulting in unauthorized charges and financial losses for developers. OpenCode urged affected users to revoke and replace credentials immediately.