Stolen AI keys ran up bills past $1,000. The keys sat in a coding tool's console.
By Lior AharonovFounder, 7IT Solutions ·
OpenCode said API keys that 1.4% of its Console users had stored for Anthropic, Google and OpenAI were exposed in an attack it calls ongoing. TechCrunch reports unauthorized charges on users' accounts, a few above $1,000. Anthropic and Google blocked keys they believed were exposed, OpenAI worked on refunds, and the open source app and CLI were not affected.
A provider key is a credit card with no spending limit you set. Paste it into one more dashboard and that dashboard's security becomes your billing risk. The first sign is often the spend alert at 3 a.m.
If you ever saved provider keys in OpenCode Console, revoke and replace them at each provider today. Check usage since 17 October and set a monthly spend cap on every AI key you own.
Every place that stores your API key is a place that can spend your money. Keep that list short, and keep it written down.
Lior Aharonov · my takeSources
Researched with AI tools; every fact is checked against the linked sources.