An intruder reached a legacy system at OpenCode, potentially exposing third-party AI provider keys saved in the OpenCode Console for 1.4% of users.
Some developers report unauthorized charges, prompting advice to revoke keys in provider dashboards.
The incident occurred on the night of October 16. OpenCode clarified that the problem only concerns its optional online work service, known as Console, and not its desktop applications, which store keys locally on the device. Through the Console service, users store digital keys for artificial intelligence services such as OpenAI, Anthropic and Google.
Which users are affected?
The company notified the 1,4% of its users who had connected external providers via email on the morning of October 17. According to OpenCode, those who did not receive the message are not affected by the incident.
These keys essentially act like access cards. Anyone who obtains them can make charges to the owner's account. Deleting a key from the Console service does not cancel it, and budget limits cannot stop this use. The company recommends that users cancel the key directly from the provider, create a new one, and update their applications.
READ ALSO
ConnectWise shuts down services after unauthorized access to accounts
Charges and estimates
Some users have reported unauthorized charges. For example, Colin Parsons reported charges of $281 to OpenAI and $168 to Anthropic, Preston Zeller reported charges of $1.700, while Reddit users reported charges of $400 to Anthropic and around €200 to Google.
OpenCode said the keys may have been exposed, without confirming whether any were copied or used. The company described the breach as the result of a broader mass data collection effort, while its co-founder said the attacks on the systems continued uninterrupted for 48 hours.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)