OpenCode Console breach leaks AI API keys of 1.4% of users; most small shops unaffected

OpenCode, an open-source AI coding agent, said on Saturday, Oct. 17, that attackers broke into an older system behind its OpenCode Console web platform, affecting 1.4% of Console users, some of whom stored API keys for AI services there, and that it notified all affected users by email. The company says its open-source app and command-line tool were not affected, refunds for unauthorized charges are underway, and affected users should revoke and replace their keys directly with each AI provider.

Primary source is OpenCode's own post on X; charge amounts and provider responses come from TechCrunch's reporting. The direct effect on a 10-to-50-person trades or services business is close to zero. OpenCode is a tool for software developers, and only Console users who got an email were hit. The wider lesson is the one worth 15 minutes. An API key is a password that bills you. Take a 25-person accounting firm that pastes an OpenAI key into a Zapier or Make workflow to pull line items off vendor invoices, spending about $40 a month. If that key leaks from any tool that stores it, a stranger can run up charges until someone notices. Affected developers reported hundreds of dollars per account, and a few reported more than $1,000 overnight. A monthly spend cap or budget alert of, say, $75 on each AI account turns an open-ended loss into a small, capped one. Check whether your provider's setting is a hard stop or only an email alert. Firms with no AI API accounts can ignore this entirely.