Hackers breach OpenCode platform, steal API keys and rack up AI charges, TechCrunch reports

Hackers breached parts of OpenCode’s online platform today, stealing some users’ API keys and triggering unauthorized charges on linked AI accounts, TechCrunch reports. OpenCode, an open-source AI coding agent used as an alternative to Claude Code and Cursor, relies on users’ paid model credentials, making exposed keys immediately costly. The incident lands amid surging adoption of AI coding tools by startups and enterprises, heightening the risk of cascading account abuse.

The attackers accessed a service component, exfiltrated keys, and spent against victims’ providers, though the scope and number of affected users were not immediately disclosed, according to TechCrunch. TechCrunch adds that when the team sought help, automated code assistants repeatedly refused to examine the malicious code, complicating response. Watch for OpenCode to detail impact, user remediation steps, and whether AI providers will void fraudulent charges. [Developing. This article will be updated.]