Hackers Hit OpenCode, Causing Charges on User Accounts
OpenCode, an open-source AI coding agent, was hit by a hacker attack. This attack resulted in high charges on users' AI accounts.
Summary: OpenCode, an open-source AI coding agent, was hit by a hacker attack. This attack resulted in high charges on users’ AI accounts.
OpenCode, an open-source AI coding agent, suffered a cyberattack. As a result of this attack, unauthorized and high-cost operations were performed on OpenCode users’ accounts with AI service providers. OpenCode is known as a popular alternative to tools like Claude Code and Cursor.
While the full technical details of the attack are not disclosed, such incidents typically occur through leaked API keys or the exploitation of a vulnerability in OpenCode’s infrastructure. Attackers might have used compromised API keys to send intensive requests to AI models on behalf of users, incurring high usage charges from service providers. This is a form of resource exploitation attack.
For live systems and infrastructure, this incident highlights the critical importance of securing API keys and credentials when using third-party AI tools. Users should activate spending limits and alert mechanisms with their AI service providers and regularly review the security posture of each tool they use. API key rotation and authorization with the “least privilege” principle are also crucial.
Engineers, especially when using open-source tools, should regularly scan the codebase and its dependencies for vulnerabilities. Furthermore, robust monitoring and alerting systems should be established to track calls to AI services and detect anomalies.
🔗 Source: TechCrunch
📡 Authoritative feeds & live tracking: Radar