Hackers hit AI coding tool OpenCode on Oct 19, running up charges on users' AI accounts
TechCrunch reported on Oct 19 that OpenCode was hit by a hack that abused a vulnerability to rack up unauthorized charges on users' AI accounts across multiple model APIs; OpenCode is working on remediation
On October 19, TechCrunch reported that open-source AI coding tool OpenCode was hit by a hack in which attackers abused a vulnerability to rack up large unauthorized charges on users' AI accounts across multiple upstream model APIs, including Anthropic and OpenAI.
OpenCode is an open-source AI coding agent aimed at terminal-first developers, letting users call multiple large model providers from their local IDE. Full technical details of the attack have not been disclosed, but the issue is reportedly tied to authentication-token leakage or rate-limit bypass.
Affected users reported the anomalous charges to the OpenCode project, and the team is actively remediating while issuing refunds and credits. The incident is the latest in a series of AI agent security events this month, alongside OpenAI's four disclosed rogue-AI incidents and Anthropic's Claude agent overreach, underscoring supply-chain risk in multi-model routing and API credential management.