Attackers broke into an older system at OpenCode, a popular open source AI coding tool, overnight and used exposed AI account keys to run up charges. OpenCode said Saturday that the breach affected 1.4% of users of its online platform, called OpenCode Console.<\/p>\n\n\n\n
This is the OpenCode breach, and it is mostly a developer story. But the lesson reaches further. If anyone in your office has connected an AI tool to a paid AI account, there is probably a secret key involved. Those keys are worth protecting.<\/p>\n\n\n\n
If you only use AI chat apps in a web browser, you can relax. Read on if you, your web person or your bookkeeping software uses AI accounts behind the scenes.<\/p>\n\n\n\n
According to TechCrunch<\/a>, some OpenCode Console users stored their API keys there. An API key is a long password that lets a program use your account at an AI company. Whoever holds the key can spend your money.<\/p>\n\n\n\n Overnight, developers posted spending alerts and unauthorized charges on Reddit and X. Some reported charges in the hundreds of dollars. A few described totals above a thousand dollars.<\/p>\n\n\n\n OpenCode said it emailed every affected user that morning. Users who did not get an email were not affected, the company said.<\/p>\n\n\n\n The response was fairly quick, according to the same report:<\/p>\n\n\n\n OpenCode co-founder Dax Raad said the exposed keys were confined to Console. The open source app and command-line tool were not affected, he said. In his words, those keys “never come to us.”<\/p>\n\n\n\n OpenCode called the incident a “distillation attack.” That is when someone pulls huge volumes of answers out of an AI model to help train a copycat. TechCrunch notes that leaked keys can help people in countries with restricted access to American models produce that volume of output.<\/p>\n\n\n\n Some skeptics say that framing is a stretch. They argue this was a straightforward breach, and that the distillation use is unproven. OpenCode did not say how the attack worked, so we can’t settle that.<\/p>\n\n\n\n There is a second debate. Raad said attackers had been trying to break in nonstop for 48 hours. His team ran AI defensive agents around the clock. But the AI models they used to analyze the malicious code started refusing, because the code tripped their safety filters.<\/p>\n\n\n\n OpenCode later got access to OpenAI’s Daybreak Blue program. It gives vetted users AI models that are less likely to refuse defensive security work. The point, as TechCrunch frames it, is that small teams without that vetted access have a harder time defending against AI-driven attacks.<\/p>\n\n\n\n You do not need to run a software company to be exposed. Here is where API keys show up in small offices:<\/p>\n\n\n\n The big risk is the bill. A stolen key does not steal your files. It spends your money, and the charges can pile up while you sleep. Here, some people’s spending alerts fired before bedtime.<\/p>\n\n\n\n The other lesson is about where keys live. Every extra place a key is stored is another place it can leak from. This breach hit an older system, which is the kind of place people forget about.<\/p>\n\n\n\n We touched on a related worry in our post on AI agents and insider threats<\/a>: tools that act on your behalf need limits, just like staff do.<\/p>\n\n\n\n This is our view, and you may see it differently. We would not call this a reason to avoid AI tools. The companies blocked keys and offered refunds, and that is how it should work.<\/p>\n\n\n\n But it shows how easily a key gets treated like a casual setting rather than a password. We think keys deserve the same care as a bank login. Use one key per tool. Set a spending limit. Delete keys you no longer use.<\/p>\n\n\n\n We also would not rush to judge the “distillation” label. The facts so far support a simpler statement: a system was breached, keys were exposed, and money was spent.<\/p>\n\n\n\n If you are not sure where your AI accounts, keys or other logins are stored, we are happy to look with you. Our free 30-minute assessment<\/a> has no cost and no contract, and it can be remote or on-site. You can also see how we help small offices on our security page<\/a>. More on AI topics is in our AI & Chatbots category<\/a>.<\/p>\n\n\n\nWhat the companies did<\/h2>\n\n\n\n
\n
Why people disagree<\/h2>\n\n\n\n
What it means for your office<\/h2>\n\n\n\n
\n
Our take<\/h2>\n\n\n\n
What to do this week<\/h2>\n\n\n\n
\n
Closing<\/h2>\n\n\n\n
Sources<\/h2>\n\n\n\n