AI coding tool breach can leave firms with unexpected API bills
In brief
According to OpenCode, attackers accessed an older system overnight and affected 1.4 percent of OpenCode Console users, some of whom store API keys for AI services. Co-founder Dax Raad said the open-source app and command-line tool were not affected. Users reported unauthorized charges of hundreds of dollars and a few above 1,000 dollars; OpenAI, Anthropic and Google acted on exposed keys and OpenCode said refunds are underway.
Source : TechCrunch - AI - « Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts »
What it changes for an SME
If you stored API keys in OpenCode Console, treat them as compromised: they can generate unauthorized usage on OpenAI, Anthropic or Google accounts. The cost risk for an SME is immediate, with reported charges in the hundreds of dollars and a few above 1,000 dollars, even though OpenCode said refunds are in progress. According to co-founder Dax Raad, the open-source app and command-line tool were not affected. OpenCode has not said how the older system was accessed and said the incident is still ongoing.
What you can do
- If you use OpenCode Console, check whether you received an email and, if you stored keys there, revoke and replace them with each provider.
- Review recent OpenAI, Anthropic and Google usage for charges you did not make.
- List every tool that currently holds your AI API keys and confirm spending alerts are on.
Let's talk about the time you could save.
In 20 minutes, we find where AI could save you time or money. Free, no commitment.