About $1,700 gone overnight—not from a crypto liquidation, but because someone stole a Key from an AI coding tool and ran up a huge bill.
The team behind OpenCode, the hugely popular open-source AI coding assistant, has confirmed that someone broke into an old cloud Console that was being phased out. The breach was linked to a large-scale distillation attack. The OpenAI, Anthropic, and Google keys stored there by about 1.4% of users who had connected external models may have been exposed. Some users have posted bills showing charges of $400–$500 to $1,700 in a single night; others say their API ran up around 35 million tokens overnight. People running it locally were unaffected—the users caught out were those who stored their Keys in a cloud workspace.
These days, it’s not just your wallet you need to protect—API Keys are hot targets too. You may think they’re just a convenient way to code, but to hackers, they’re ready-made ATMs.
The team behind OpenCode, the hugely popular open-source AI coding assistant, has confirmed that someone broke into an old cloud Console that was being phased out. The breach was linked to a large-scale distillation attack. The OpenAI, Anthropic, and Google keys stored there by about 1.4% of users who had connected external models may have been exposed. Some users have posted bills showing charges of $400–$500 to $1,700 in a single night; others say their API ran up around 35 million tokens overnight. People running it locally were unaffected—the users caught out were those who stored their Keys in a cloud workspace.
These days, it’s not just your wallet you need to protect—API Keys are hot targets too. You may think they’re just a convenient way to code, but to hackers, they’re ready-made ATMs.