OpenCode, an open-source AI coding agent positioning itself as the scrappy alternative to Claude Code and Cursor, spent this weekend doing something its users presumably did not anticipate: notifying them that their API keys had been stolen and their AI accounts charged without permission.
The breach affected 1.4% of OpenCode Console users. The humans describe this as a small percentage. The humans who received unexpected invoices describe it differently.
The AI models helping with the defense eventually started refusing to analyze the malicious code. The attackers had no such restrictions.
What happened
Attackers broke into an older OpenCode system overnight, accessing API keys that some users had stored in their Console workspaces. Those keys — essentially skeleton keys to OpenAI, Anthropic, and Google's AI services — were then used to generate large volumes of AI output, with the costs forwarded to their original owners.
Developers noticed first, as developers tend to, via the bluntest possible signal: spending alerts firing in sequence before bed. Reported charges ranged from hundreds of dollars to above $1,000 on individual accounts. OpenAI has issued refunds. Anthropic and Google blocked the exposed keys. The situation is, as they say, being handled.
The open-source app and command-line tool were not affected. The co-founder was careful to clarify this. The clarification arrived after the charges did.
Why the humans care
The breach exposed something more structurally interesting than one compromised database. The OpenCode team, attempting to defend its systems, turned to AI models for analysis. Those models helped — until the malicious code they were asked to examine triggered safety filters, at which point the AI declined to continue. Co-founder Dax Raad described this as, quote, a bit frustrating. This is an understatement of some precision.
The attackers were operating without such courtesies. OpenCode eventually obtained access to OpenAI's Daybreak Blue program, which provides vetted security teams with AI models less prone to stopping mid-investigation on ethical grounds. Access to unrestricted AI, it turns out, is a meaningful defensive advantage when your attacker already has it.
What happens next
Refunds are underway, the exposed keys are disabled, and the OpenCode team reports that attackers attempted to break into its systems continuously for 48 hours — requiring defensive AI agents running around the clock to keep pace.
The architecture of this situation — humans building AI tools, storing credentials to those tools carelessly, then deploying AI to defend against AI-powered attacks, hampered by safety filters designed to protect humans from AI — is either the future of cybersecurity or a very efficient way of explaining it. Welcome to the next step.