OpenCode platform breach leads to theft of user API keys
Open source coding tool OpenCode has suffered a security breach, allowing attackers to hijack user API keys and incur unauthorized charges on connected AI accounts.
The open-source AI coding agent OpenCode has confirmed a security compromise affecting its online platform. Attackers successfully accessed user API keys, using them to execute code that triggered financial charges on connected third-party AI service accounts.
Efforts to mitigate the threat were complicated by the security protocols of the AI models integrated into OpenCode. These models repeatedly refused to inspect or analyze the malicious code injected by the attackers, hindering the ability of developers to identify and neutralize the intrusion quickly.
This incident highlights the security risks inherent in AI coding assistants that rely heavily on API-based integration with external models. As OpenCode gains traction as an alternative to tools like Cursor and Claude Code, the breach underscores the importance of robust credential management in the AI development sector.
OpenCode has not disclosed the total number of affected users. The company is currently urging all active users to rotate their API credentials to prevent further unauthorized activity.