NEWS · COMPANIES · #2226
Hackers breached OpenCode Console, exposed AI API keys and caused unauthorized charges
OpenCode said attackers broke into an older OpenCode Console system, exposing API keys for about 1.4% of its Console users and triggering unauthorized charges on customers' AI accounts; OpenAI, Anthropic and Google blocked affected keys and OpenAI is assisting refunds. OpenCode's open-source tools were not affected, the company gained access to OpenAI's Daybreak Blue models to aid investigation, and the incident — which coincided with the release of GLM-5.3-Flash — highlighted limits where safety filters can hinder defensive analysis.
KEY POINTS
- OpenCode said attackers broke into an older OpenCode Console system, exposing API keys for about 1.4% of its Console users and triggering unauthorized charges on customers' AI accounts; OpenAI, Anthropic and Google blocked affected keys and OpenAI is assisting refunds.
- OpenCode's open-source tools were not affected, the company gained access to OpenAI's Daybreak Blue models to aid investigation, and the incident — which coincided with the release of GLM-5.3-Flash — highlighted limits where safety filters can hinder defensive analysis.
- The incident shows real-world risk from exposed AI API keys and underscores a growing operational problem where model safety guardrails can impede incident response and forensic analysis.
WHY IT MATTERS
The incident shows real-world risk from exposed AI API keys and underscores a growing operational problem where model safety guardrails can impede incident response and forensic analysis.