Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts
TL;DR
OpenCode is an open-source AI coding agent that's become a popular alternative to Claude Code and Cursor. But hackers got into part of its online platform and stole some users’ API keys, and the AI tools it turned to for help kept refusing to look at the malicious code.
Nauti's Take
Teams using OpenCode or similar coding agents should immediately scope API keys tightly, isolate production credentials, set spending limits, and inspect logs for unusual token usage. The source base is thin, so verify which keys were exposed, whether access has been revoked, and how the platform reviews embedded code before moving a critical workflow onto it.
Sources
