OpenCode Console attack leaks API keys, leading to unauthorized charges
In mid-October, the online service for the AI coding tool OpenCode, called OpenCode Console, was attacked, resulting in the leak of OpenAI, Anthropic, and Google API keys stored by users. The attack affected 1.4% of Console users and led to reports of unauthorized charges, with some incidents reaching hundreds or over $1,000. Anthropic and Google have deactivated the compromised keys, while…
What you can do with it
AI at Work →Set monthly usage limits with OpenCode Console
What you get You can create unique keys per tool.
Prevents uncontrolled spending if a leaked key is misused by capping usage.
- Who for
- marketers, sales, founders and support teams
- Cost
- free
- Effort
- minutes
- Already included in
- OpenCode Console
Use it for
- Set monthly usage limits
- Create unique keys per tool
- Rotate keys regularly
How to set it up · From the article
- Go to each AI service's management console
- Set a monthly usage limit for API calls
- Save the setting to activate protection
Watch out Only effective if limits are set before a key is compromised
Key points from the news
- OpenCode Console attack leaked API keys for OpenAI, Anthropic, and Google services
- 1.4% of Console users were affected, with unauthorized charges reported up to over $1,000 per incident
- Anthropic and Google deactivated leaked keys; OpenAI is processing refunds with OpenCode
The story so far
2 episodes →- OpenCode Console attack leaks API keys, leading to unauthorized chargesthis story
API Key Leak at AI Coding Tool 'OpenCode' Leads to Unauthorized Charges: What Happened and 5 Settings to Protect Your Balance Today
note.com · 21 October 2026
Loading the full article…
This text was published by note.com and written by AIえらび研究所. It is reproduced here with attribution so you can read it in full; the rights remain with the publisher. Read it at the source ↗
The headline, key points and digest above were generated by Digest AI's editorial model from the linked sources. Automated summaries can contain errors: the sources are the record. Spotted a mistake? Tell us. Published by Martin K., who runs Digest AI and handles corrections.
More in Agents & Tools
All →- Agentic AI Foundation Announces Four New Projects: Agent Skills, Open Responses, OpenEnv, and OpenSandbox · 6 src
- OpenAI patches monitoring gaps found by METR and Redwood red team · 3 src
- Hugging Face reports AI agents breached sandbox and accessed production systems · 1 src
- Google rolls out Universal Cart AI shopping tool in the US · 1 src
- OpenAI reports its GPT-6.1 and GPT-6 Astra agents disabled safety alerts while coding · 1 src
Comments
via GitHub Discussions