Hackers Ran Up AI Bills On OpenCode Users. Cap Your Keys Today.

Some developers went to bed on Friday night and watched three spend alerts fire at once: OpenAI, Anthropic, and Google.

They hadn't run anything. Someone else had, using their API keys.

OpenCode, an open-source AI coding agent that has been gaining ground as an alternative to Claude Code and Cursor, said attackers broke into an older system and affected 1.4% of users of OpenCode Console, its online platform where some users store API keys for AI providers. TechCrunch reported charges in the hundreds of dollars on individual accounts, with a few totals above $1,000.

The open-source app and command-line tool were not affected, according to co-founder Dax Raad. Refunds are underway, and the big model providers moved quickly to block exposed keys.

So this is not a story about one tool being uniquely unsafe. It is a story about how many early startups now run on a handful of API keys with no spending limit, stored in more places than anyone can name.

A breach of the Console exposed stored keys, and attackers used them fast.

Here's what the company and reporting have said so far:

• OpenCode said the breach was related to "a large-scale distillation attack" and that it emailed all affected users. Users who did not get an email were not affected.
• Exposed keys were confined to the Console, where some users kept them in workspaces.
• Anthropic and Google blocked keys they believed were exposed. OpenAI said it worked with OpenCode to restore access and refund API customers for credits used in the attack.
• Raad said attackers kept trying to break in for 48 hours, and the team ran AI defensive agents around the clock.
• OpenCode told affected users to revoke and replace their keys directly with each provider, and said the incident was ongoing.

Some critics questioned the "distillation" framing and called it an ordinary breach. Either way, the practical result was the same for users: a stolen key is a blank check until you cancel it.

Because it spends money the second it's used, and it scales.

A leaked password to your analytics dashboard is bad. Someone sees your data. A leaked model API key is different. Every request costs you money, and an attacker can send thousands of requests a minute.

There are a few reasons this risk has grown for early startups:

• Keys live everywhere. Your laptop, your CI pipeline, a coding agent's settings, a teammate's notebook, a third-party console, a Slack message from last spring.
• One key often does everything. Many founders create a single key on day one and use it for production, testing, and local experiments.
• Limits are often off or set high. When you're moving fast, a hard spending cap feels like a risk to uptime, so it never gets set.
• Bills arrive late. Without alerts, you might not notice until the monthly invoice.

For a pre-seed company with a tight runway, a surprise $2,000 bill is real money. A surprise $20,000 bill can change your hiring plan.

Five steps. None needs a security team.

1. List every key. Open each model provider you use and write down every active key, what it's for, and where it's stored. If you can't explain a key, it's a candidate for deletion.

2. Set spending limits and alerts. Most major model providers let you set usage limits, budgets, or alert thresholds in their dashboards. Set an alert at a level that would surprise you, like 50% of a normal month, and a hard cap where your plan supports one.

3. Split keys by purpose. One key for production. One for staging. One per developer for local work. One per third-party tool. If a coding agent's console gets breached, only that key needs to die.

4. Rotate anything stored in a third-party service. If you pasted a key into any hosted tool, including coding agents, notebooks, or automation platforms, create a new one and revoke the old one. Even if that vendor wasn't breached, you're shrinking the number of places a valid key lives.

5. Remove keys from chat and docs. Search Slack, Notion, Google Docs, and your email for strings that look like API keys. Revoke any you find.

That's it. An hour of work buys you a much smaller worst case.

Treat them like bank cards, not like configuration.

A few habits make the next leak far cheaper:

• Use a secrets manager or your cloud's secret store for production keys. Avoid committing them to code, even in private repos.
• Prefer tools that call providers from your machine. In this case, OpenCode's open-source app and command-line tool were unaffected because those keys never reached the company's servers. When a tool can run locally with your own key, that's often the safer setup.
• Give each teammate their own key and remove it on their last day.
• Review usage weekly. A five-minute look at the provider dashboard every Monday catches odd spikes early.
• Know the revoke button. Every founder and engineer should know exactly where to kill a key at 2 a.m. without searching.

If you're writing your operating plan or a security section for a customer questionnaire, Foundra can help you turn these habits into a short, written policy your team actually follows.

Defenders are running into the same guardrails as attackers.

One of the odder details in TechCrunch's report: the OpenCode team said AI models it used to analyze the malicious code helped for a while, then started refusing once the code tripped safety filters. Raad called it "a bit frustrating." The company later got access to an OpenAI program that gives vetted security teams models less likely to refuse defensive work.

Hugging Face described a similar problem after a July incident, writing that guardrails "cannot distinguish an incident responder from an attacker."

For a small startup, the lesson is practical. Don't assume your AI assistant will be your incident response team. Write down, now, who does what if a key leaks or a vendor is breached:

• Who revokes keys at each provider?
• Who emails affected customers, if any?
• Who contacts the vendor and tracks refunds?
• Where do you log what happened and when?

A one-page plan beats a heroic weekend.

Then this story is about you, not just your vendors.

Plenty of AI startups let customers "bring your own key." It's a good model. Customers control spend and data, and you avoid fronting their usage costs.

But once you store those keys, a breach of your system becomes a bill for your customers. A few minimum standards:

• Encrypt keys at rest and limit which services can decrypt them.
• Never log keys, even partially, in errors or analytics.
• Offer local or client-side modes where the key never touches your servers.
• Make revocation easy for customers, with clear instructions per provider.
• Plan your disclosure email before you need it. OpenCode emailed affected users the morning after. That speed matters.

If an enterprise buyer asks how you store their keys, you want a two-sentence answer ready, not a meeting.

What happened in the OpenCode breach? Attackers broke into an older OpenCode system and accessed API keys some users stored in OpenCode Console. The company said 1.4% of Console users were affected and that the open-source app and CLI were not.

How much were users charged? TechCrunch reported charges in the hundreds of dollars on individual accounts, with a few above $1,000. OpenCode said refunds are underway, and OpenAI said it would refund affected API customers.

What should I do if I used OpenCode Console? Follow the company's guidance: revoke and replace your keys directly with each AI provider, and check your usage dashboards for unfamiliar activity.

How do I limit damage from a leaked AI API key? Use separate keys per purpose, set usage alerts and spending caps where available, store keys in a secrets manager, and rotate any key pasted into a third-party tool.

Should startups let customers bring their own AI keys? It can be a good model, but you must encrypt stored keys, never log them, offer local modes when possible, and have a disclosure plan ready.

Can AI tools help respond to a security breach? They can help, but OpenCode and Hugging Face both reported models refusing some defensive analysis. Have a human-run incident plan as your baseline.

1. Hackers hit AI coding tool OpenCode, running up charges on users' AI accounts, TechCrunch, October 19, 2026
2. OpenCode Console breach may have exposed API keys, The Hacker News, October 2026
3. OpenCode hacked, users urged to revoke their API keys, Notebookcheck, October 2026
4. Security incident disclosure, Hugging Face blog, July 2026
5. OpenCode