OpenCode's console is breached and stored AI keys run up charges
In shortAttackers broke into an older OpenCode system and used the AI provider keys some users had stored there.
What happened
Attackers got into an older system behind OpenCode Console, the online platform where some OpenCode users store the API keys they use for AI services. The company said 1.4% of the platform's users were affected.
The stolen keys were used to run up charges on those users' AI accounts. OpenAI, Google and Anthropic said they worked with affected customers to revoke the keys and deal with the charges.
Why it worked
The keys were stored with a third party, and the breach happened on that third party's servers. Nothing on the user's own laptop was involved.
What EndLayer shows or does
- Not covered
A breach on a vendor's servers. An agent on your devices cannot prevent it or see it happen.
- Available now
Which devices run OpenCode, and which hold AI provider keys and under what variable name, so you know whose keys to rotate first. Roadmap →
- Available now
Token usage from OpenCode's local records, priced. Charges made with a stolen key elsewhere do not appear in those records; the provider's billing does. Roadmap →