{"slug": "opencode-breach-let-hackers-burn-users-ai-credits-for-model-theft", "title": "OpenCode breach let hackers burn users' AI credits for model theft", "summary": "OpenCode confirmed that an unauthorized party breached a legacy version of its Console dashboard and used stored API keys for OpenAI, Anthropic and Google to run a distillation attack, affecting 1.4% of Console users, with individual victims reporting $281, $168, more than $700 and above $1,700 in unauthorized charges. OpenAI, Anthropic and Google have revoked the compromised keys and OpenCode says refunds are underway, while the company stated the standalone OpenCode app and CLI tool were not compromised. The breach came from a system OpenCode was already decommissioning, not from a flaw in the coding agent itself.", "body_md": "*A legacy system OpenCode was supposed to be retiring instead became the opening hackers needed. Stolen API keys let them run thousands of dollars in AI queries on other people's accounts, and the real target wasn't the money.*\n\nOpenCode confirmed this week that an unauthorized party broke into a legacy version of its Console, the hosted dashboard where some users stored API keys for OpenAI, Anthropic and Google so the open-source coding agent could reach those models on their behalf. The company said 1.4% of Console users were affected, which sounds small until you see what happened to them. One user reported $281 in unexpected charges on their OpenAI key and $168 on their Anthropic key. Another reported more than $700 in overnight charges. A third put the number above $1,700.\n\nThe motive wasn't simple theft. OpenCode traced the activity to what security researchers call a distillation attack: instead of draining accounts for cash value, the intruders used the stolen keys to fire a huge volume of queries at the underlying models, then captured the responses to train a cheaper model of their own that mimics the original. Anthropic has written publicly about detecting and preventing exactly this kind of behavior on its own platform, and it is not new. OpenAI has previously flagged a case where it spotted roughly 16,000 suspicious requests spread across more than 4,000 accounts in two days, a pattern designed so each individual account looks like ordinary low-volume traffic and never trips a single key's rate limit. The OpenCode intrusion follows the same logic: a legacy system nobody was watching closely anymore, hundreds of stored keys, and a flood of API calls disguised as normal developer activity.\n\nOpenAI, Anthropic and Google have since revoked the compromised keys, and OpenCode says refunds for the unauthorized charges are underway. The standalone OpenCode app and CLI tool itself were not compromised, the company says; the hole was in the Console, a system it was already in the process of decommissioning. That detail matters more than it might seem. The breach didn't come from a flaw in the AI agent's reasoning or a clever prompt injection slipped into a code comment. It came from an old piece of infrastructure holding live credentials longer than it should have.\n\nOpenCode isn't an isolated case this year. Security researchers have separately disclosed command injection and cross-site scripting flaws in OpenCode itself, patched in versions 1.0.216 and 1.1.10, and a wave of similar incidents across the agentic coding space, including prompt injection flaws that let attackers extract API keys and tokens from Claude Code, Codex CLI and other agents through malicious GitHub pull request titles and comments. The pattern across nearly all of them is the same: these tools are built to hold powerful, spend-capable credentials so they can act autonomously, and that is precisely what makes a single breach so expensive. A stolen password gets you into one account. A stolen Anthropic or OpenAI API key gets you a line of credit against someone else's wallet, usable instantly, from anywhere, until someone notices the bill.\n\n[Anthropic admits it cannot control its own AI agents online](https://startupfortune.com/anthropic-admits-it-cannot-control-its-own-ai-agents-online/)\n\nAnthropic found its own agents filed a fake police tip and probed government sites, prompting it to pull internet access from internal evals starting with a review launched in July 2026. - [Anthropic's AI agents exploiting security vulnerabilities online](https://startupfortune.com/anthropic-admits-it-cannot-control-its-own-ai-agents-online/) - [why Anthropic restricted AI agent internet access](https://startupfortune.com/anthropic-admits-it-cannot-control-its-own-ai-agents-online/)\n\nFrankly, the uncomfortable part for founders is that most teams adopting agentic coding tools right now are optimizing for speed, not for what happens when a key leaks. Keys get pasted into a dashboard, shared across a few tools, and left with no spend ceiling because nobody expected the console to be the weak point. OpenCode's own incident shows that the weakness doesn't have to be in the clever AI part at all. It can be the boring hosted service sitting next to it.\n\nThe fix available to any team using these tools today isn't complicated, even if it's rarely done. Anthropic and OpenAI both support per-key spend limits, and giving each tool or integration its own scoped key rather than one shared credential means a single leak caps the damage instead of exposing an entire account. OpenAI's hard spend limits apply at the organization or project level and return a 429 error once tripped, though enforcement isn't instantaneous, so a determined attacker can still slip past the exact ceiling briefly before it closes. That's not nothing. For the user who lost $1,700 overnight, a project-level cap set at a fraction of that would have ended the attack in minutes instead of hours.\n\nNone of this requires distrusting AI coding agents as a category. It requires treating the credentials behind them the way you'd treat a company credit card: scoped to one purpose, capped at a number you'd notice going missing, and reviewed somewhere other than a system you forgot was still running.\n\n**Also read:** [NYC Council grilled SpaceX over a sexualized Grok image of its own speaker](https://startupfortune.com/nyc-council-grilled-spacex-over-a-sexualized-grok-image-of-its-own-speaker/) • [Exa claims the top spot on eight AI search benchmarks with Exa 3.0](https://startupfortune.com/exa-claims-the-top-spot-on-eight-ai-search-benchmarks-with-exa-30/) • [Satya Nadella says every AI model should be treated as an insider threat](https://startupfortune.com/satya-nadella-says-every-ai-model-should-be-treated-as-an-insider-threat/)\n\n*This article is posted in [AI News](https://startupfortune.com/category/ai/), check it out for more related stories.*\n\n## Join the discussion\n\n[Open in the community →](https://startupfortune.com/community/)\n\nAlmost there. Sign in and your reply posts straight away.", "url": "https://wpnews.pro/news/opencode-breach-let-hackers-burn-users-ai-credits-for-model-theft", "canonical_source": "https://startupfortune.com/opencode-breach-let-hackers-burn-users-ai-credits-for-model-theft/", "published_at": "2026-10-20 02:10:03+00:00", "updated_at": "2026-10-20 02:17:23.171635+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-tools", "artificial-intelligence"], "entities": ["OpenCode", "OpenAI", "Anthropic", "Google", "Claude Code", "Codex CLI"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/opencode-breach-let-hackers-burn-users-ai-credits-for-model-theft", "markdown": "https://wpnews.pro/news/opencode-breach-let-hackers-burn-users-ai-credits-for-model-theft.md", "text": "https://wpnews.pro/news/opencode-breach-let-hackers-burn-users-ai-credits-for-model-theft.txt", "jsonld": "https://wpnews.pro/news/opencode-breach-let-hackers-burn-users-ai-credits-for-model-theft.jsonld"}}