TechCrunchHigh Impact
OpenCode Console Breach Exposes AI API Keys, Users Hit With Charges
The short answer
Attackers broke into an older OpenCode system and used stored AI provider keys, leaving some developers with unauthorized bills. Any API key you store in a third-party tool is a credit card number.
- security
- API keys
- breach
What happened
TechCrunch reports the breach affected 1.4% of OpenCode Console users. Some reported charges in the hundreds of dollars. Anthropic and Google blocked exposed keys, OpenAI worked on refunds, and affected users were told to revoke and replace their keys.
What it means for your business
Any API key you store in a third-party tool is a credit card number. Set spending limits and alerts with each AI provider and rotate keys you no longer use.
Source: TechCrunch