OpenCode Breach Exposes Developer API Keys and Runs Up Bills

An open-source AI coding agent that many developers picked as a cheaper alternative to Claude Code and Cursor spent the weekend firefighting a straight-up key theft. OpenCode says attackers broke into an older system behind OpenCode Console, the hosted dashboard where users store third-party API keys, and made off with credentials belonging to 1.4% of Console accounts.

The damage showed up as billing alerts. Developers woke up to spend notifications firing across OpenAI, Anthropic and Google accounts at once, with some reporting charges in the hundreds of dollars and a few above $1,000. OpenCode notified affected users by email, and all three model providers blocked the keys they believed were exposed. OpenAI said it worked with OpenCode to restore access and refunded API customers for credits burned in the attack.

Co-founder Dax Raad stressed that the breach was confined to Console, not the open-source CLI: "those keys never come to us." But the distinction is doing less work than it sounds. Console exists precisely so teams can plug their provider keys into a workspace, and storing other people's credentials server-side turns a routine intrusion into a credential heist. Commenters on the disclosure pushed on that design choice more than on the intrusion itself.

The guardrails that refused to help

The part builders should read twice is what happened during the response. OpenCode kept AI defensive agents running around the clock for 48 hours to triage the intrusion. The models helped for a while and then started refusing, because the malicious payloads they were asked to analyze tripped safety filters. The team only got traction after being granted access to OpenAI's Daybreak Blue program, which gives vetted defenders models that are less likely to refuse security work.

That failure mode is not new. Hugging Face hit the same wall in July, when commercial models blocked its attempts to analyze logs from an intrusion, and described it as "the asymmetry problem": guardrails "cannot distinguish an incident responder from an attacker." David Sacks, co-chair of the President's Council of Advisors on Science and Technology, drew the same conclusion publicly: the guardrails backfired.

Why it matters for builders

Two lessons, both cheap to apply today. First, treat third-party model keys as production secrets: scoped, per-project, spend-capped, rotated on any hint of exposure, and ideally never stored in a vendor dashboard you do not control. Second, assume your incident-response stack will hit a refusal at the worst moment. Keep a vetted route to unrestricted defensive analysis, or an open-weight model you can run yourself, before you need it.

The intrusion itself is still being pieced together. The framing as a "large-scale distillation attack" remains unproven, and skeptics have argued it was a plain breach whose use for model distillation has not been demonstrated. What is not in dispute is the bill, the exposed keys, and the fact that the defenders' own tools hesitated.