OpenCode, an open-source AI coding agent popular as an alternative to Claude Code and Cursor, says attackers broke into an older part of its online platform overnight on Friday, affecting 1.4% of users of OpenCode Console, TechCrunch reports.
Some users stored API keys for AI services in Console. Developers reported spending alerts and unauthorised charges, in a few cases above $1,000. Anthropic and Google blocked the exposed keys, OpenAI said it was refunding affected customers, and OpenCode said refunds were under way.
The company linked the breach to a large-scale distillation attack, though some sceptics questioned that description. Co-founder Dax Raad said the open-source app and command-line tool were not affected, and that attackers had tried to break in continuously for 48 hours.
Source: TechCrunch
