OpenCode Console breach exposes some users’ AI service keys
By Automate Basics, written with AI from TechCrunch's original
OpenCode says attackers accessed an older system and exposed AI service keys stored by some OpenCode Console users. Affected teams should replace those keys with their AI providers and check for unauthorized usage.
What changed
OpenCode says attackers entered an older system connected to OpenCode Console, its online platform where some users store keys for AI services. The company notified affected users by email. Developers also reported unexpected spending alerts and charges on accounts with AI providers, according to TechCrunch.
OpenCode says refunds for unauthorized charges are underway. TechCrunch reports that Anthropic and Google blocked keys they believed were exposed, while OpenAI worked with OpenCode to restore access and refund affected API customers for credits used in the attack. The incident concerns keys kept in Console workspaces, not the open-source app or command-line tool, according to OpenCode co-founder Dax Raad.
Who is affected by the OpenCode Console breach?
OpenCode Console users who received a breach notification are the group OpenCode identified as affected. The company says users who did not receive an email were not affected. The distinction matters at work because a team can use OpenCode’s open-source app without storing its AI provider keys in Console.
TechCrunch does not specify which Console plans include key storage or what Console costs. It also does not give a complete account of how the attackers entered the older system or everything they did with exposed keys. For a team managing several AI provider accounts, the practical question is whether any of its keys were kept in an affected Console workspace.
How should I check my AI accounts at work?
Teams notified by OpenCode should replace affected keys with each AI provider, as OpenCode has advised. Check spending alerts and provider usage records for activity the team does not recognize, then confirm that work relying on replacement keys still runs as expected. Those checks are especially useful when several people or workflows share responsibility for an AI account.
OpenCode says the incident remains ongoing, so an initial billing check may not settle every question. Keep a record of unfamiliar charges and the keys replaced so the team can follow up with the relevant provider. TechCrunch reports that refunds are underway, but the source does not say when every affected account will be resolved.
Frequently asked questions
Was the OpenCode app breached?
OpenCode co-founder Dax Raad says the exposed keys were confined to OpenCode Console workspaces. According to Raad, the open-source app and command-line tool were not affected. The reported risk is to AI provider keys that some users stored in the online Console.
What should I do if OpenCode emailed me about the breach?
OpenCode has advised affected users to revoke exposed keys and create replacements with each AI provider. Check those provider accounts for unfamiliar usage or charges. OpenCode says refunds for unauthorized charges are underway, but TechCrunch does not report a completion date.
Does no notification mean my account was unaffected?
OpenCode says users who did not receive a notification email were not affected by this incident. The company identified the exposure as involving keys stored in OpenCode Console, rather than keys used only with its open-source app or command-line tool.
For you
Learn to do this with AI, free
Short courses for people who aren't engineers: ChatGPT, Claude, prompting and automation. Every lesson is free, with no card.
Start a free courseFor companies
Make an AI or automation tool?
List it in the directory for $9.99, refunded in full if it isn't approved, or claim its page if it is already here.
Related reading
AWS releases TorchNeuron to run PyTorch apps on TrainiumAWS has released TorchNeuron, a tool it says lets teams move PyTorch AI apps to its Trainium chips without rewriting code. For workplaces running their own AI models, it offers another hosting option to assess.
Google adds BigQuery analysis with Gemini to SheetsGoogle says Gemini in Sheets can now answer questions about connected BigQuery data and build charts and tables from it. The feature is for people with permission to query that data through Connected Sheets.
Google adds student insight summaries to Gemini Notebook in ClassroomGoogle is adding Gemini-powered insight summaries to teacher-assigned notebooks in Google Classroom. Educators can review patterns in student conversations and check individual chats, while administrators can control sharing with trusted domains.
Written with AI from TechCrunch's original and published after automatic checks: every figure here appears in the original, and no sentence is copied from it. The picture is AI-generated. The original is the authority.
Get the next one by email
One email, most weeks: what changed in AI for people who use it at work, and what to do about it.
Source: Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts, TechCrunch, 19 Oct 2026.