Hackers breach AI coding tool OpenCode, causing charges to users' AI accounts

Open-source AI coding agent OpenCode stated that attackers intruded into its legacy systems at night, affecting 1.4% of users of the OpenCode Console online platform, some of whom stored API keys for accessing AI services on that platform. Multiple developers reported unauthorized charges on Reddit and X, reaching hundreds of dollars for a single account, with a few exceeding 1000 dollars. Anthropic and Google banned keys they believed had been leaked; OpenAI stated it is working with OpenCode to restore access and is refunding the used quota for affected API customers, and OpenCode said refunds for unauthorized charges are underway. OpenCode called the incident a large-scale knowledge distillation attack; some skeptics believe that purpose has not yet been confirmed; co-founder Dax Raad said the leaked keys were limited to Console, and the open-source application and command-line tool were unaffected.