Hackers Breach OpenCode, Drain Users' AI Accounts With Stolen API Keys
Attackers got into part of OpenCode's online platform and made off with users' API keys, which they then used to run up charges on victims' AI accounts. OpenCode is an open-source AI coding agent that has become a popular free alternative to Claude Code and Cursor, which makes its user base both large and cost-sensitive. In an ironic twist, the AI tools the team turned to for help reportedly refused to analyze the malicious code.
OpenCode is an open-source AI coding agent positioned as a direct alternative to Claude Code and Cursor
Hackers compromised part of the project's online platform and exfiltrated user API keys
Stolen keys were used to accumulate charges on victims' AI provider accounts
AI assistants asked to inspect the malicious code declined to engage with it