OpenCode hacked, users urged to revoke their API keys
2026-10-17
Notebookcheck
The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.
A legacy system breach at OpenCode exposed API keys for OpenAI, Anthropic, and Google, affecting 1.4% of Console users. Attackers used stolen keys to run expensive AI queries, resulting in unauthorized charges and financial losses for developers. OpenCode urged affected users to revoke and replace credentials immediately.[AI generated]
Why's our monitor labelling this an incident or hazard?
The event involves the use and misuse of AI systems' API keys, leading to unauthorized usage and financial harm to users, which qualifies as harm to property (financial loss). The breach also disrupted user access to AI services, indicating operational disruption. Since the AI systems (Anthropic, OpenAI, Google AI services) are directly involved and the harm has materialized, this qualifies as an AI Incident. The ongoing nature and the direct harm to users' accounts and finances confirm this classification.[AI generated]