Attackers took API keys stored in OpenCode's console and ran up charges, some above $1,000. Check where your automation keys live

Your API key is only as safe as the least protected tool you pasted it into.

What happened

OpenCode, an open source AI coding agent, said attackers broke into an older system overnight, affecting 1.4% of users of its online platform, OpenCode Console. TechCrunch reports that some users stored the API keys for their AI services there. Developers posted spending alerts and unauthorized charges, with some in the hundreds of dollars on individual accounts and a few above $1,000. Notebookcheck reports one user saw $400 in unauthorized charges on an Anthropic account.

Anthropic and Google blocked the keys they believed were exposed. OpenAI said it worked with OpenCode to restore access and refund its API customers. OpenCode said refunds for unauthorized charges are underway. According to co-founder Dax Raad, the open source app and command line tool were not affected, only keys stored in Console workspaces. Notebookcheck reports OpenCode's email said the breached system was a legacy system it was in the process of decommissioning. OpenCode told affected users to revoke and replace their keys with each provider, update the apps using them and review recent usage. The company said the incident remains ongoing.

My take

This is the risk nobody budgets for in automation work. A client's AI key ends up in five places: the automation platform, a coding tool, a test script, a teammate's laptop, an old SaaS trial. Any one of those can leak, and the bill lands on the client.

What I set up for every client build now:

• One key per tool or workflow, never a shared master key, so revoking one does not break everything
• Hard spending limits and usage alerts on every provider account
• A short register of where each key lives and who owns it
• A rotation step written down before launch, not invented during an incident

Note what saved some users here: spend alerts fired before OpenCode's email arrived. If your client has no alert set, they find out from the invoice. Also notice the breach hit a legacy system being retired. Old tools you stopped using still hold your keys until you revoke them.