OpenCode disclosed that attackers accessed an outdated system connected to its Console platform, compromising API keys for approximately 1.4% of Console users. The breach allowed unauthorized use of AI services linked to those keys, resulting in unexpected charges on affected accounts.
The company emphasized that the vulnerability affected an older infrastructure, which has since been isolated to prevent further intrusion. While the number of impacted users remains limited, some customers reported charges nearing $1,000 due to illicit AI service activity.
OpenCode urges all Console users to review their API key usage and upgrade to more secure subscription plans as a preventative measure. The incident highlights the importance of maintaining updated security protocols, especially in platforms that integrate with third-party AI tools requiring API authentication.
Although no personal user data was reported stolen, the exposure of API keys poses significant risks by allowing malicious actors to harness AI resources under legitimate accounts. OpenCode is collaborating with cybersecurity experts to strengthen defenses and assist affected users in mitigating financial and security impacts.