GoKawiilOpenCode breach exposes API keys, triggers unauthorized AI spending charges
OpenCode, an open-source AI coding tool, disclosed a security breach affecting 1.4% of users of its OpenCode Console platform, where some store API keys for AI services. The company described it as a large-scale distillation attack and notified affected users by email, while developers reported unexpected charges on OpenAI, Anthropic and Google AI accounts, some exceeding $1,000. Anthropic and Google blocked exposed keys, OpenAI worked with OpenCode to restore access and refund credits, and OpenCode said refunds for unauthorized charges are underway.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident suggests that leaked API keys can be exploited not just for theft but potentially to extract AI model outputs at scale, a tactic sometimes used to train rival models—though skeptics quoted dispute that distillation was proven here. It also points to a broader vulnerability for companies offering developer access to AI APIs, where breaches can quickly translate into real financial harm for end users. The varied responses from OpenAI, Anthropic and Google hint at inconsistent industry practices for handling such breaches and compensating affected customers.
- OpenCode breach hit 1.4% of its Console platform users, exposing stored API keys.
- Developers reported unauthorized charges on OpenAI, Anthropic and Google AI accounts, some over $1,000.
- OpenCode called it a distillation attack, but some skeptics question that characterization; refunds are being processed.
Source: techcrunch.com — Aditya Mehta, 2026-10-19
Published there as: “Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.