# OpenCode Console attack leaks API keys, leading to unauthorized charges

Digest AI · Agents & Tools · published 2026-10-21T08:54:00Z

Canonical: https://digestai.news/story/opencode-console-attack-leaks-api-keys-leading-to-unauthorized-charges

## Summary

In mid-October, the online service for the AI coding tool OpenCode, called OpenCode Console, was attacked, resulting in the leak of OpenAI, Anthropic, and Google API keys stored by users. The attack affected 1.4% of Console users and led to reports of unauthorized charges, with some incidents reaching hundreds or over $1,000. Anthropic and Google have deactivated the compromised keys, while OpenAI is working with OpenCode to process refunds. The OpenCode software running locally is unaffected, and the company has contacted affected users via email. The article also outlines five security settings users should implement to prevent future leaks, including setting usage limits, using separate keys, deleting unused keys, adding .env to .gitignore, and enabling GitHub's protection features.

## Key points

- OpenCode Console attack leaked API keys for OpenAI, Anthropic, and Google services
- 1.4% of Console users were affected, with unauthorized charges reported up to over $1,000 per incident
- Anthropic and Google deactivated leaked keys; OpenAI is processing refunds with OpenCode

## Why it matters

The incident highlights the risks of entrusting API keys to third-party services and underscores the need for users to implement basic security practices like usage limits and key rotation to prevent financial loss.

## Sources

1. [API Key Leak at AI Coding Tool 'OpenCode' Leads to Unauthorized Charges: What Happened and 5 Settings to Protect Your Balance Today](https://note.com/ai_erabi/n/nd0e43c77b461?hl=en) (note.com, 2026-10-21)

Part of the developing story: [OpenCode Console API Key Breach Saga](https://digestai.news/thread/anomaly-innovations-says-breach-affected-about-1-4-of-opencode-console-users) (2 stories)

## Cite

Digest AI, "OpenCode Console attack leaks API keys, leading to unauthorized charges", 21 October 2026, https://digestai.news/story/opencode-console-attack-leaks-api-keys-leading-to-unauthorized-charges

---

Written by Digest AI's editorial model from the linked sources; the sources are the record. Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse
JSON: https://digestai.news/story/opencode-console-attack-leaks-api-keys-leading-to-unauthorized-charges.json