OpenCode Says Breach Hit 1.4% of Console Users, Charges Topped $1,000
Summary
OpenCode says attackers breached an older system overnight, affecting 1.4% of OpenCode Console users whose stored API keys ran up unauthorized charges, some above $1,000. Anthropic and Google blocked exposed keys, OpenAI refunded API customers, and OpenCode says refunds are underway.
Key Points
- Co-founder Dax Raad says the open source app and command-line tool are unaffected because those keys never reach OpenCode.
- Raad says attackers try to break into its systems nonstop for 48 hours, forcing AI defensive agents to run around the clock.
- David Sacks says frontier models refused to analyze the exploits needed for defense and that "the guardrails backfired."