An overnight breach of an older OpenCode system impacted 1.4% of Console users, resulting in unauthorized API charges exceeding $1,000 due to stored service keys.
While the standalone app and CLI tool were unaffected, major providers revoked exposed keys and initiated refunds.
The breach affected 1,4% of users of the online service OpenCode Console, where some stored digital access keys to artificial intelligence services. Overnight, developers began reporting on social media notifications of exorbitant charges, with amounts ranging from hundreds to over a thousand dollars.
The reaction of the company and providers
OpenCode said it notified affected users via email the following morning. The company's co-founder Dax Raad said the open-source application and command-line tool were not affected by the incident.
The companies behind the services responded quickly. Anthropic and Google blocked the keys they believed had been exposed, while OpenAI worked with OpenCode to restore access and refund customers for the units consumed in the attack. OpenCode said that refunds for unauthorized charges are in progress.
READ ALSO
Malicious code in paid version of popular WordPress plugin
Obstacles to research
During the analysis, the OpenCode team encountered difficulties because the AI security filters refused to examine the dangerous files associated with the attack. Later, the company gained access to a special OpenAI program with models that do not deny corresponding defense tasks.
OpenCode has not specified how the attackers gained access to the system, how the keys were stored, or the overall extent of the misuse, but it noted that the situation remains active. Affected users are urged to cancel and replace their keys directly with each provider.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
