Picture this: someone copies your house key, lets themselves in while you sleep, and starts ordering takeout on your tab. They don’t steal the TV or break anything. They just spend. And you don’t find out until the bill shows up.
That’s roughly what happened to some users of OpenCode, an AI coding tool that has won over a lot of developers lately. According to TechCrunch, attackers got into part of its online platform and grabbed the keys that connect those users to their AI services. Then they put those keys to work for themselves, and the charges landed on the victims’ accounts.
What is OpenCode, and why do so many people use it?
OpenCode is what the industry calls an “AI coding agent”: an assistant that doesn’t just suggest the next line of code, but can read an entire project, propose changes, and carry out tasks almost like a tireless coworker.
Two things explain its rise. First, it’s open source, meaning anyone can see how it’s built, tweak it, and use it without paying for a license. Second, it has become a popular alternative to commercial tools like Anthropic’s Claude Code and Cursor.
But OpenCode doesn’t run on magic. To do its thinking, it relies on the big AI models on the market, and that’s where this story gets interesting.
The key to the cash register
For a tool like OpenCode to use those models, users hand it an API key. In plain English, that’s a kind of password that tells the AI provider, “Bill this to me.”
Think of it as a credit card with no chip and no PIN. Whoever holds it can use the service, and every request gets charged to the owner. That’s exactly why these keys are so attractive to criminals. They don’t need to drain your bank account. They just need to milk your AI account for their own purposes while you foot the bill.
That’s what happened here. The attackers walked off with some users’ keys and started using them, driving up usage and, with it, the charges.
The irony: the AI that wouldn’t help
The most striking part of this story has the feel of a tech-world punchline. When the OpenCode team turned to other AI tools to help examine the malicious code the attackers left behind, those tools kept refusing to look at it.
This isn’t a glitch or a whim. Major AI companies build guardrails into their models so they won’t help create or improve harmful software. The idea makes sense: nobody wants a chatbot to become a cybercriminal’s perfect sidekick.
The problem is that those guardrails can’t always tell the difference between someone building the weapon and someone trying to defuse it. And in the middle of an attack, when every minute counts, hearing your assistant say “Sorry, I can’t help with that” is the last thing you need.
Why should you care if you don’t write code?
You may never have written a line of code in your life, but this story hits closer to home than you might think:
- More and more apps run on AI behind the scenes. Many of the tools you use every day depend on these same kinds of keys and these same providers.
- Your bill is the new loot. In the AI era, stealing access to a paid service can be just as profitable as stealing personal data.
- Free and open has its risks, too. Open source is fantastic, but once a tool gets popular, it also becomes a very tempting target.
- AI safety filters cut both ways. They protect us, but sometimes they also get in the way of the people trying to fight back.
What to do if you use OpenCode or a similar tool
If you use OpenCode, or any service that asks you to connect your AI account, a few simple steps go a long way:
- Rotate your API keys. Revoke the old ones in your AI provider’s dashboard and generate new ones. It’s the digital equivalent of changing the locks.
- Check your usage. Look through your usage history and billing for any charges you don’t recognize.
- Set a spending cap. Most providers let you set a monthly limit and turn on alerts. If someone gets in again, at least the damage has a ceiling.
- Don’t reuse one key everywhere. Use a separate key for each tool. If one gets compromised, the others stay safe.
- Reach out to your provider if something looks off. The sooner you flag suspicious charges, the easier they are to sort out.
The bigger lesson
This episode leaves us with an uncomfortable but useful takeaway: AI isn’t just changing what we can do, it’s changing what criminals want to steal. It’s no longer only about passwords or card numbers. It’s about access to machines that work, think, and bill by the hour.
There’s a lesson here for the companies building these models, too. If they’re going to put a seatbelt on AI, they’ll need to fine-tune it carefully, so that seatbelt doesn’t end up tying the hands of the people trying to put out the fire.
