OpenCode Hacked: Stolen API Keys Spark Massive AI Billing Fraud

TL;DR

• OpenCode's managed cloud platform Zen was breached via a malicious unverified admin package, allowing attackers to exfiltrate users' Anthropic, OpenAI and other API keys and rack up unauthorized AI usage charges.
• The OpenCode team revoked all keys, shut down the compromised service, and is rebuilding Zen from scratch while urging developers to rotate keys, audit billing, and check for unexpected usage.
• Security researchers warn the incident highlights supply-chain risks in AI coding tools, compounded by the fact that major AI assistants initially refused to analyze the malicious code due to built-in safety filters.

What Happened to OpenCode

OpenCode, the fast-growing open-source alternative to Claude Code and Cursor, confirmed this week that its online platform was compromised in an attack that stole developer API keys and triggered widespread billing fraud.

The breach did not affect the core open-source CLI that most developers run locally. Instead, hackers targeted OpenCode Zen, the company's hosted service that handles authentication, usage-based billing, and shared AI model access. Once inside, the attackers were able to siphon connected API keys for providers like Anthropic, OpenAI, Google, and OpenRouter, then use them to run expensive inference workloads on victims' accounts.

Founder Steve Sewell, known online as sst, disclosed the incident in a public post, telling users to assume any key connected to Zen was compromised. The team immediately revoked tokens, took Zen offline, and began notifying affected users.

An Open Source Darling Becomes a Target

OpenCode exploded in popularity over the past year as developers looked for a terminal-first, highly customizable coding agent without vendor lock-in. Unlike Cursor or Claude Code, OpenCode is fully open source, supports more than 75 large language models, and lets users bring their own API keys.

That BYOK model is exactly what made it lucrative for attackers. With direct access to valid, funded API keys, criminals could resell access or power their own AI operations without paying for compute. In underground forums, stolen AI keys with high limits have become a hot commodity as demand for cheap Claude, GPT-5 and Gemini access surges.

How The Attack Happened

According to OpenCode's preliminary breakdown and independent analysis from security researchers, the intrusion began with a malicious package published to the Zen service.

Attackers allegedly managed to get an unverified admin package approved into the platform's distribution channel. Because Zen automatically trusted packages with admin scope, the malicious code executed with elevated privileges and gained access to the secrets store where user API keys were held.

Once installed, the payload quietly exfiltrated keys to external infrastructure and opened the door for mass reuse. Some users reported seeing thousands of dollars in unexpected Anthropic and OpenAI charges within hours, with activity originating from unfamiliar IP addresses and regions.

Researchers described it as a classic supply-chain attack supercharged by AI economics: instead of stealing crypto wallets or passwords, the hackers stole raw AI compute.

Impact On Developers: Surprise Bills And Scramble To Rotate Keys

For individual developers and startups, the fallout has been painful.

Dozens of users reported unauthorized usage spikes, depleted credits, and maxed-out rate limits. One developer shared a $2,000 overnight Anthropic bill from API calls they never made. Others woke up to emails from OpenAI warning of suspicious activity.

OpenCode has urged all Zen users to take immediate action:

• Rotate every API key ever entered into OpenCode Zen, not just Anthropic or OpenAI keys
• Revoke Zen sessions and disconnect integrations
• Review billing dashboards for Anthropic, OpenAI, Google AI Studio, and OpenRouter for the past 30 days
• Enable spending caps, hard limits, and usage alerts if you haven't already

The company says local-only OpenCode installations that never connected to Zen or entered keys into the cloud service are not affected. It has also promised to publish a full post-mortem and to move to audited, signed builds with isolated secrets management when Zen relaunches.

Why AI Assistants Refused To Analyze The Malicious Code

In a strange twist that fueled debate on X and Hacker News, developers trying to investigate the malicious package found that Claude, ChatGPT, and other leading AI assistants refused to analyze it.

When pasted into chat, the models flagged the code as potentially malicious and declined with a standard safety refusal: I can't help analyze malware or facilitate wrongdoing. That left researchers unable to use their everyday AI tools to quickly dissect command-and-control URLs, obfuscated exfiltration logic, or persistence mechanisms.

AI safety experts say this is a known overcorrection in current guardrails. Models are tuned to avoid helping create malware, but they often also block legitimate defensive analysis by security professionals. OpenAI, Anthropic and Google all allow malware analysis in theory for defensive purposes, but automated filters still trigger on obvious key-stealing and exfiltration code.

Frustrated researchers ultimately turned to local open-weight models with safety filters disabled, or to manual reverse engineering, to confirm what the payload did. The episode has reignited calls for a dedicated security research mode in AI assistants that permits analysis of live threats without enabling creation of new ones.

What This Means For The Future Of AI Coding Tools

The OpenCode hack is the most serious security incident yet for the new generation of agentic coding tools, and it carries lessons far beyond one startup.

First, bringing your own key is convenient but dangerous when those keys are stored in a centralized cloud. Security experts recommend using scoped keys with strict dollar limits, separate keys per tool, and short expiration windows.

Second, the incident underscores how AI developer infrastructure has become critical supply-chain infrastructure. A single compromised admin package was enough to cascade into thousands of downstream victims - a pattern previously seen with npm, PyPI and GitHub Actions attacks.

OpenCode says Zen will remain offline until it can be rebuilt with end-to-end encryption for secrets, third-party audits, and transparent package verification. Competitors Cursor, Windsurf and Claude Code have not reported similar breaches, but all are facing fresh scrutiny over how they store customer credentials.

For now, the message to developers is blunt: if you used OpenCode Zen, consider your API keys burned. Rotate them now, and watch your next AI bill very closely.

AndroGuider Team

Articles written by the AndroGuider team. We try to make them thorough and informational while being easy to read.