What we know

Hackers breached OpenCode, an open source AI coding tool, stealing some users’ API keys. These stolen keys were then used to incur unauthorized charges on users’ AI service accounts. OpenCode has gained popularity as an alternative to AI coding agents like Claude Code and Cursor.

Why it matters

OpenCode’s breach highlights risks associated with AI coding platforms that rely on user API keys for access. Users affected by the hack faced unexpected charges, raising concerns about security measures protecting sensitive credentials. As OpenCode grows in popularity, ensuring robust safeguards against such attacks is critical to maintain user trust and prevent financial harm.

What is still unknown

The full scope of the breach, including how many users were impacted and the exact vulnerabilities exploited, remains unclear. There is no information on any patches or security updates released in response. Details about OpenCode’s supported programming languages, accuracy, and broader release plans were not provided. No independent tests of the tool’s security or performance have been reported.