Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts

OpenCode, an open-source AI coding agent, suffered a security breach on an older system, affecting 1.4% of OpenCode Console users who store API keys. Attackers ran up charges on users' AI accounts, with some bills exceeding $1,000. OpenCode attributed the breach to a 'large-scale distillation attack.' Anthropic and Google blocked exposed keys, while OpenAI restored access and issued refunds. The team faced difficulties using AI models for defense due to safety filters, highlighting a broader 'asymmetry problem' where guardrails hinder incident response. The incident drew attention from government advisors and occurred amid a rise in AI-enabled cyberattacks.

(Source：TechCrunch)