Quick answer: AI API keys are now prime targets for hackers. In October 2026, attackers broke into an older system at OpenCode, a popular open-source AI coding tool, and exposed provider API keys belonging to 1.4% of OpenCode Console users. Some developers woke up to charges of hundreds of dollars, and a few reported more than $1,000. Here is what happened and a practical checklist to protect your own OpenAI, Anthropic, Google and other AI keys.
What happened at OpenCode
- Attackers broke into an older system behind OpenCode Console, where some users had stored their AI provider API keys.
- The open-source app and command-line tool were not affected; OpenCode says keys used there “never come to us”.
- Stolen keys were used to run up charges overnight. OpenCode called it a “large-scale distillation attack”, where stolen access is used to harvest model outputs, though some experts questioned that label.
- Anthropic and Google blocked the exposed keys; OpenAI worked with OpenCode on access and refunds. OpenCode says refunds for unauthorised charges are under way.
- OpenCode told affected users to revoke and replace their keys directly with each provider.
Why AI keys are so valuable to attackers
An AI API key is effectively a credit card connected to a very expensive service. With a stolen key, attackers can run large volumes of requests on your bill, resell access, or use powerful models without the safety checks and identity checks of a normal account.
Checklist: how to protect your AI API keys
Storage
- Never put keys in code, front-end JavaScript, mobile apps or public repositories. Use environment variables or a secrets manager.
- Add
.envto.gitignoreand turn on secret scanning on GitHub or GitLab. - Be careful which tools you give keys to. Every third-party app that stores your key is another place it can leak from.
Limits
- Set monthly spending limits and low-balance alerts on every provider dashboard.
- Use separate keys per project and environment (development, staging, production), so one leak doesn’t expose everything.
- Restrict keys where the provider allows it, for example by project, model or IP address.
- Prefer prepaid credits over unlimited post-paid billing for side projects.
Monitoring and response
- Check usage dashboards weekly for unexpected spikes, new models or odd hours.
- Rotate keys regularly, and immediately if a tool you use reports a breach.
- If a key leaks: revoke it at the provider first, create a new one, update your apps, then contact the provider’s support about fraudulent charges.
For website and app owners
If your website or app calls an AI API, the key must live on your server, never in browser code where anyone can read it. Put a backend route between your users and the AI provider, and add rate limits so one visitor can’t run up your bill.
AI tools are also being used to attack websites directly; see how one hacker used AI agents to breach 100+ websites.
Frequently asked questions
What happened in the OpenCode breach?
Attackers broke into an older OpenCode Console system and exposed AI provider API keys belonging to 1.4% of Console users, leading to unauthorised charges.
What should I do if my AI API key is leaked?
Revoke it immediately on the provider’s dashboard, create a new key, update your apps, and contact support about any fraudulent usage.
Can I set a spending limit on AI APIs?
Most major providers let you set usage limits and alerts in their dashboards. Turn them on for every account.
Is it safe to put an API key in JavaScript?
No. Any key in browser or mobile app code can be extracted. Keep keys on your server.
Sources: TechCrunch; BleepingComputer; Crypto Briefing; Cyera research.
