OpenCode, an open-source AI coding agent positioned as an alternative to Claude Code and Cursor, was targeted by hackers who gained access to part of its online platform. According to the report, the attackers stole some users’ API keys and used them to run up charges on those users’ AI accounts. The report also notes that AI tools called on for help repeatedly declined to examine the malicious code involved.
Why it matters
The incident highlights the security risks tied to coding agents that connect to users’ AI accounts via API keys. Stolen keys can translate directly into financial costs for affected users.
Who should care
Users of OpenCode and similar AI coding tools should take note, particularly those who have stored API keys with the platform.