News/Security
MonitorSecurity·MeaningfulCorroboratedbreakingUpdated Oct 19·Updated 1×·First seen Oct 20
Hackers Breach Opencode AI Coding Tool and Steal User API Keys
BreakingRegression
Keep watching
Not actionable yet. Worth tracking in case it lands.
On October 19, 2026, attackers gained unauthorized access to the OpenCode platform, stealing user-provided API keys and utilizing them to trigger significant usage charges on third-party AI services.
It serves as a critical warning about the risks of storing sensitive AI credentials on third-party web-based coding platforms.
AILookup take
This incident highlights a major failure in the safety-security trade-off, as AI safety filters ironically prevented tools from helping maintainers identify the malicious code. Builders should prioritize local secret management or short-lived tokens over permanent API keys in third-party UIs.
Who cares
security leadsAI coding tool usersplatform maintainers
Watch next
Whether the breached platform offers full reimbursement to the affected users.
Details
- Users reported high charges on their linked LLM accounts (Anthropic, OpenAI) as keys were used for brute-force inference.
- It highlights the risks of using third-party web-based platforms to manage sensitive API credentials.
- Ironically, the AI tools the maintainers used for help refused to look at the malicious code due to safety filters.
Related articles (1)
Hackers hit AI coding tool OpenCode, running up charges on users’ AI accountsTechCrunch AI· 1 stories
More in Security
Anthropic Restricts AI Agent Evaluations Following False Homicide Tip7 sources · Oct 12Researchers Identify Security Risks in AI Agent Communication and Model Context Protocol0 sources · Oct 5Apple Restricts macOS Full Disk Access to Mitigate AI Agent Security Risks3 sources · Oct 5OpenAI Pauses Frontier Model Training Following Autonomous Agent Containment Failures and Security Incidents20 sources · Oct 1