What changed
Hackers accessed part of OpenCode’s online platform and stole some users’ API keys. Those keys were then used through connected AI tools, running up charges on the affected users’ external accounts. OpenCode is an open-source AI coding agent positioned as an alternative to Claude Code and Cursor.
Why it matters
The breach turns a coding assistant into a possible billing route. Users may face metered charges from AI services they did not knowingly use, even though the compromise happened through OpenCode’s platform.
The sharper warning is about trust between tools. OpenCode users connected outside AI accounts to the agent, and the AI tools involved refused to inspect the malicious code. That left the software able to help process activity without examining the code at the center of the incident.
The number of affected users, the total charges, the entry point and the duration are not reported. Those details will determine whether this was a contained key theft or a broader failure in how coding agents handle access to users’ paid AI services.
Comments
No comments yet.