Open-source AI coding agent OpenCode has confirmed a security breach after an attacker gained access to a legacy system, exposing users' third-party API keys. The incident affected 1.4% of users of its 'Console' service, which stores credentials for platforms including OpenAI, Anthropic, and Google.
Following the breach, multiple users reported significant, unauthorized charges to their connected AI service accounts, with some individual losses ranging from hundreds to over a thousand dollars. OpenCode has notified the affected users and advised them to revoke and reissue their API keys. The company is working with the AI providers to address the issue.