OpenCode Console breach exposes users' API keys
What happened
On 20 October 2026, TechCrunch reported that open-source AI coding agent OpenCode disclosed that its legacy system was breached overnight, affecting 1.4% of users on the OpenCode Console platform. API keys stored by some users were exposed and used to generate unauthorised charges, with some users losing hundreds of dollars on a single account and a few losing more than $1,000. The incident is still developing, and OpenCode has not yet published further details on how it will respond.
Written by AI from the reports · updated 3 h ago
Timeline
Follow the reports to see the event from each side.
- TechCrunch · AIHackers hit AI coding tool OpenCode, running up charges on users’ AI accounts
OpenCode is an open-source AI coding agent that's become a popular alternative to Claude Code and Cursor. But hackers got into part of its online platform and stole some users’ API keys, and the AI tools it turned to for help kept refusing to look at the malicious code.
Heat of this event
Not enough continuous observations yet to draw a trend.