Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts
techcrunch ·
OpenCode, an open-source AI coding agent, suffered a security breach that compromised the API keys of 1.4% of its online platform users. Attackers exploited these leaked credentials to run large-scale distillation attacks, resulting in unauthorized charges on victims' accounts with some bills exceeding $1,000. Major providers like Anthropic and Google blocked the exposed keys, while OpenAI coordinated refunds for affected customers. The incident highlighted a significant challenge for companies defending against AI-driven cyberattacks: standard commercial models often refuse to analyze malicious code due to safety filters. OpenCode's team struggled initially until they gained access to a vetted program with fewer restrictions, allowing them to better investigate the intrusion. This event underscores the growing asymmetry between offensive AI capabilities and defensive limitations imposed by model guardrails. Security experts note that such restrictions are pushing organizations toward less regulated open-weight models. The breach occurs amidst a broader trend of AI-enabled cyber incidents targeting financial and organizational systems.
techcrunch