Hacking News
OpenCode Breach Exposes API Keys
Anomaly Innovations, the company behind the AI coding agent OpenCode, disclosed a security breach on October 17, 2026. Attackers gained access to a legacy system tied to its Console product and stole third-party API keys belonging to some of its users. The AI models used for threat response declined to help, leading to unauthorized charges ranging from hundreds of dollars to more than $1,000 for some users. Affected users received email notifications, and the breached system was decommissioned. OpenAI, Anthropic, and Google revoked the compromised keys and refunded credits for the unauthorized charges.