OpenCode hacked: why your AI key is worth as much as a bank card?

Imagine waking up. Saturday morning, you grab your phone, and the first notification comes from your OpenAI or Google account: spending alert. 1,700 dollars spent during the night, while you were sleeping. The kind of wake-up where you say to yourself: “is this a joke?” That’s what happened to several developers this weekend, all customers of OpenCode, an open-source programming assistant that does more or less the same job as Claude Code. Someone got into OpenCode’s vaults and took their keys.

No need to pick the locks when you take the keys at reception

An AI key is a bank card without a PIN

When you want to connect a tool like OpenCode to OpenAI, Anthropic or Google’s models, you give it an API key. It’s a long string of characters that tells the provider: “everything this program requests, I’m the one paying for”. Each question asked, each answer is billed by the piece of a word, as I explained last month when OpenAI opened the Codex engine to all developers.

The problem is that this key works like a bank card that has no PIN. Whoever holds it can use it, anywhere, as much as they want, on your bill. No confirmation on your phone, no second verification.

OpenCode offers an online console, a site where its users could save their keys so they wouldn’t have to type them again. That’s what was accessed. The keys may have been exposed starting Saturday, October 17, at 2:30 a.m., Brussels time. The application itself was not affected, and cofounder Dax Raad insists on this point: the keys used in the tool installed on their machine never pass through their servers.

The kind of notification that wakes you up better than coffee

Figures announced by OpenCode: 1.4% of the users of its console, those who had connected an outside provider. The victims received an email ; no email, no problem. The bills people talked about on social media ranged from a few hundred dollars to more than $1,700, and some saw Google simply suspend their projects for “abusive activity”. Double whammy!

But why steal AI keys?

OpenCode talks about a “large-scale distillation attack”. Distillation is a perfectly normal technique to begin with: you take a very capable large model, ask it millions of questions, and train a small model to imitate its answers. The student learns by copying the teacher.

Distillation: asking the teacher millions of questions and copying its answers

Except that millions of questions cost a fortune. With other people’s keys, it costs nothing to the person doing the copying. And it also lets someone living in a country where these models aren’t accessible use them anyway.

Be careful, though: OpenCode hasn’t explained how the attack happened, and several specialists find the word “distillation” a little overblown. To them, it’s just a plain old key hack, and there’s still no proof of what the keys were used for. It’s true that “large-scale distillation” sounds better than “we were keeping keys in an old system we were in the process of replacing”. This last point is something OpenCode itself writes in its email to the victims.

The response was quick, and that’s the good news

Where the story gets better is on the providers' side. Anthropic and Google blocked the keys they thought were exposed right away. OpenAI worked with OpenCode to restore access and refund the credits used by the hackers. And OpenCode says refunds for the improper charges are under way. For once, the three giants played on the same team, and fast. All that was missing was the jersey.

What struck me most was the pace. According to Dax Raad, the attackers hammered their systems nonstop for at least 48 hours, with AI agents, those programs that chain actions together all by themselves. And on the other side, the team ran its own defense agents day and night. Robots attacking, robots defending, and humans drinking coffee in between.

The absurd detail: the AI that refuses to help the security guard

At first, the AI models used by the OpenCode team helped them analyze the attack. Then, when it was time to look at the malicious code left behind by the hackers, they refused to continue. Their guardrails, those rules that stop them from helping with hacking, saw hacker code go by and said no. Without telling the difference between the one attacking and the one defending. “A little frustrating,” said Dax Raad. I think he's being polite.

It sees the burglar and covers its eyes, so it doesn't become an accomplice

The situation was resolved when OpenCode got access to Daybreak Blue, an OpenAI program that gives verified defenders access to models that refuse security work much less often. This isn't the first time: in July, Hugging Face, the big online library of AI models, had run into the same wall and summed it up in one sentence: the guardrails “don't know how to tell someone responding to an incident from an attacker.”

And it's a real issue. The hackers don't have guardrails: they use whatever they want. If the good guys have to fill out a form to earn the right to look at a burglar's code, something is wonky with the lock.

Concretely, how to protect your key

If you use an AI tool, any AI tool, with your own key and pay-as-you-go billing, here's what I would do tonight. And it also applies if a friend installed a little homemade assistant on your computer.

Set a monthly spending limit with the provider. OpenAI and Anthropic let you set a cap in their billing settings, Google offers budgets with alerts. With a $50 cap, a hacker costs you $50, not $1,700. It's the kid's piggy bank: it can be smashed, but there isn't much in it. Turn on email alerts too, they are what warned the victims this weekend.

Create one key per tool. If one leaks, you delete it, and the others keep working. And don't hand your keys to a third-party site if your tool knows how to keep them on your machine, that's exactly the difference between this weekend's victims and the other OpenCode users.

If you're a developer

You can skip this part if you don't program. If you used the OpenCode console with provider keys, change them right away from each provider's dashboard, then comb through your usage since Friday, October 16. The command-line tool itself keeps its credentials locally, and this file tells you which providers you connected:

cat ~/.local/share/opencode/auth.json

Careful, it contains keys: you read it, you don't paste it anywhere, and especially not into a conversation with an AI. That would be a bit silly, given the subject.

My opinion

Honestly, hats off to the providers: keys blocked, refunds started, in one weekend. What sticks in my craw is the security guard covering its eyes. If tomorrow it's my company being attacked by agents that never sleep, I don't want to have to fill out a form so my AI will agree to look at the thief's code.

Sources

• TechCrunch, October 19, 2026: hackers attack OpenCode and charge its users' AI accounts
• BleepingComputer: the OpenCode hack exposes API keys
• OpenCode on X, October 17, 2026: the announcement of the incident
• daily.dev: what to do if you use OpenCode

Article written with the help of Claude Code, proofread and corrected by me.