OpenCode Leak Exposes Developer API Keys, Draining AI Accounts

Developers around the world woke up to a nasty surprise this week: their prepaid AI credits, the balances that pay for calls to models like OpenAI’s GPT, Anthropic’s Claude and Google’s Gemini, had been drained overnight. The culprit was not a clever new attack on the model makers themselves, but a security hole in OpenCode, a popular open-source AI coding tool used to write and debug software with the help of large language models.

According to the OpenCode team’s own post-mortem, the flaw left API keys stored in user workspaces exposed. API keys are the long passwords that let a program bill requests to a developer’s account. Once attackers had them, they simply pointed their own scripts at the most expensive models available and let them run, burning through token balances in hours. OpenCode said roughly 1.4 percent of its Console users were affected, a small share but still a painful one for a tool with a devoted following among programmers.

The timing could hardly be worse. AI coding assistants have become one of the fastest-adopted categories in software, with developers wiring model access into their daily workflow through tools like OpenCode, Cursor and similar editors. That convenience concentrates risk: a single leaked key can unlock four or five vendors’ services at once, and usage-based pricing means the damage scales with the attacker’s appetite rather than any fixed cap.

What makes the episode notable is how ordinary it is. Cloud services have suffered key leaks for a decade, but AI accounts are unusually attractive targets because they are prepaid, easy to resell and often left with generous limits. Many developers treat a few dollars of credit as disposable and skip the rotation habits that security teams drill into staff. The result is a soft underbelly across the whole AI tooling ecosystem, not just one project.

The incident also tests the open-source model. OpenCode’s transparency, a public admission and a fast patch, is exactly what many users say they want from the tools they trust with credentials. But transparency does not restore a drained balance, and affected developers have been left to chase refunds with the model providers, who see only valid-looking requests arriving from a legitimate key.

Expect the fallout to push teams toward tighter key management: scoped keys with spending limits, automatic rotation, and separate credentials for each vendor so one leak cannot cascade. Some will move toward provider-side controls that cap daily spend or require approval for unusually large bursts of usage. The lesson is familiar from the cloud era, but AI is teaching it again at speed.

For the broader industry, the OpenCode leak is a reminder that the race to build AI agents and coding copilots is also a race to secure them. The models may be getting smarter, but the plumbing around them, keys, permissions and billing, remains where the real damage happens. Developers who once judged tools on benchmark scores are now asking a harder question: who holds the keys, and what happens when they slip.