Kepler Oates

← AI News

AI tools

Hackers ran up AI bills through OpenCode. How to protect your API keys

· 1 min read · Drafted with AI help, reviewed by Kepler Oates

If you pay for AI by the token, your API key is basically a credit card. That is the lesson from a break-in at OpenCode, a popular open-source AI coding agent, TechCrunch reports. Attackers got into an older system and used stored keys, and some developers woke up to charges in the hundreds of dollars, a few to more than $1,000.

What happened

  • The break-in. Attackers got into an older OpenCode system overnight. OpenCode says it affected 1.4% of users of OpenCode Console, its online platform where some people store their AI provider keys.
  • Surprise bills. Developers reported spending alerts and charges they did not make, according to TechCrunch.
  • The company's explanation. OpenCode called it "a large-scale distillation attack," meaning the stolen keys were used to pull huge volumes of output from AI models. OpenCode has not explained how the attackers got in, and some skeptics say the distillation label is unproven.
  • Still ongoing. The company said the incident "remains ongoing," and that attackers had tried to break in nonstop for 48 hours.
InteractiveWere you affected?Pick the part of OpenCode you use.
  • OpenCode Console: The online platform: some users hit. Affected: 1.4% of Console users, per OpenCode. How you know: Affected users got an email from OpenCode. What to do: Revoke and replace your keys with each AI provider.
  • Open-source app: Not affected. Affected: No, per co-founder Dax Raad. Still worth it: Check your AI providers' usage pages for anything odd.
  • Command-line tool: Not affected. Affected: No, per co-founder Dax Raad. Still worth it: Set spending limits with your AI providers.

Source: TechCrunch, Oct 19, 2026, citing OpenCode and co-founder Dax Raad.

How it is being fixed

  • OpenCode emailed affected users and told them to revoke and replace their keys directly with each provider. If you did not get that email, OpenCode says you were not affected.
  • Anthropic and Google blocked the keys they believed were exposed, TechCrunch reports.
  • OpenAI worked with OpenCode to restore access and refund credits used in the attack. OpenCode says refunds for unauthorized charges are underway.

Protect your keys, whatever tool you use

The steps from OpenCode come first; the rest are good habits for anyone building with AI.

InteractiveLock down your AI API keysTap a step, or use Next. Steps 3 to 5 are general good practice, not from the article.
  1. Revoke any key you have shared with a tool Do it on each AI provider's own dashboard, not inside the tool.
  2. Create a fresh key Give it a clear name, like the tool it is for, so you can kill it alone later.
  3. Set a spending limit and alerts Most AI providers let you set a monthly budget and email alerts. A cap turns a disaster into an annoyance.
  4. One key per app If one tool leaks, you only replace one key, and you can see which tool was the problem.
  5. Look at your usage weekly Unusual spikes are the first sign of a stolen key.

Steps 1–2 follow OpenCode's advice to affected users, per TechCrunch. Steps 3–5 are our general tips.

Why it matters

More people are connecting AI tools to their own paid accounts. Each connection is a key someone else holds. Treat them like passwords with a credit card attached.

Sources

Not financial advice. This summarizes public reporting for information only. It is not investment, tax or legal advice. Do your own research or talk to a licensed professional.