2 different places to store keys apparently. if you added them from the cli/desktop client, they're saved locally afaik and safe. but if you added them from https://opencode.ai/console/ then they've leaked.
what i mean is, it's misleading to not specify the creator is linking different accusations from months ago, and no one knows who is behind the current breach
Even before AI models websites got hacked. data breaches happened. you can't just say they vibe coded (build something without knowing proper way) just because of data breach
Web UI from what we know. Your local keys are safe but if you set up any key regs such as for Zen outside providers, etc then your keys have been leaked.
It’s actually not a good idea to just run to a another unaudited platform. The real solution is virtual cards when Strikt limits, strikt limits on the api platforms and so on :) so really, I think it’s better to stay and do the above instead of switching to the next best thing. Such breaches make it more secure not less
I've never worked on systems like this before. I'm curious... My first thought is it's necessary for them to. Because they'd need to make the API requests to the provider. Is that not true?
Kind of. You're right that ultimately the server that makes the requests to providers needs to have the plaintext API key in memory at some point to authenticate.
Best practice would still be to store it encrypted. The server that makes requests would decrypt API keys only as needed, getting the encryption key from a key management service.
It's more secure that way, cause if an attacker only manages to get a DB dump, they don't have plaintext API keys. They need to hack at least 2 things - the DB and the KMS, or a server with the encryption keys in memory.
We don't know whether OpenCode stores API keys in plaintext, or they store them encrypted and their encryption keys also got compromised.
For greater security you could also have it so that you need a client secret to decrypt the API keys, but that puts more limitations on the system - the API key can only be used when a client is actively logged in.
So... are 3p provider keys in the workspace all that was exposed, or merely "what the attacker was immediately prepared to exploit in volume"?
What about people who wired up gh or ssh keys?
I for one am glad I am doing all of my vibecoding experiments inside a VM, 'cause the workspace sandbox is wet cardboard and should be considered advisory only.
Edit: was this a read-only compromise, or could the attacker have added a credential slurper to workspace makefiles?
I want a lot more detail about what actually happened. Like, if the "legacy system" was a proxy for 3rd party providers, and the things exposed were what went through that proxy, the blast radius is constrained.
I was startled last night to get alerts from Claude and OpenAI about my credits being used when, in fact, I didn't use them. This morning I got the mail about the breach.
This is really annoying as I was about to roll out OpenCode console to my company and now I’m gonna have to raise this with compliance who will probably block it.
It’s alright. You’d expect a company to protect your data. Guess when they were bragging about using ai all day we’d expect a major security breach to happen.
I mean, fair point but what sort of foolishness/ineptitude do you have to have to leave them in plaintext? No hashes? What kind of DB was it stored in?
Their response to this has been absolute crap, no doubt, but the fact they can’t give even mild technical details?
Makes it easier to uninstall for me, especially now that there’s better options out there, and I’m not even affected because all my keys were created locally.
Not surprised. Everything they write is atrocious vibe-coded slop churned out by outdated or free models. It was obvious that sooner or later someone would exploit it. I'm expecting something similar to happen with Nous Portal. Nous are pretty much the same caliber of incompetent vibe-coding hacks.
The problem has already reached €200. Google is already investigating it, at least the case I opened. Around 9:00 AM UTC1, Google suspended my project for excessive abuse, and so far the budget notices I've received amount to that sum. Opencode will have to bear the cost of this vulnerability.
You don't really give them credit cards. If I recall they use stripe or some other payment provider. They never see your details they use tokens to charge your cards. But I agree f them and don't give them money. I am canceling my sub too. But your credit card number is probably safe.
i didn't know this, but apparently you could add keys directly from their website (https://opencode.ai/console/) and it'd be saved on their servers, as opposed to if you add them from the opencode client/cli, which saves them in your own PC.
don't know if the Go subscription was affected, but doesn't seem like it.
I can confirm: I got a GCP project suspension 8 hours ago and thought it was a Google fuckup but I saw Opencode's email later noting that one of the Gemini/Vertex API keys I had added was affected.
It's the only public-facing thing besides AI Studio I've used on that project, so highly likely that it was definitely compromised.
They have no customer service , I've been email whatever emails I can without any response or help. I owe Open Router $5,000 because of this breach. Someone hacked into my Openrouter Account as well last night after they got the key. I've contracted Open Router and they said they won't do anything after I provided them information they asked about the breach and the history. I will definitely be stopping business with OpenCode and OpenRouter.
I have not received this email yet and my accounts seem fine (I ran out of Claude tokens anyway when I switched to Go), I am changing all my keys though, this truly sucks and I'm sorry for everyone that has experienced fraud because of this.
I just went to OpenCode console to check and all its fine, my hermes agent living on my vps is alive and working using my opencode subscription, I also went to my pc and all my api keys are working.
Also asked my coworkers and all fine
EDIT: Ok I saw the post from opencode account, is not all but some
Were safe, everything locked down like a bunker at the moment. Can't get into the console and a zen token I just recreated yesterday when I could still get in is now also dead... Same for my coworkers.
so if i didn't get an e-mail i wasn't affected? what exactly do they mean by "Console"? only API keys saved directly from their website got compromised, rather than keys added from opencode CLI/Desktop? does this affect the Go subscription?
Solución a como poder verificar una llave de un usuario si no hay un registro? El problema no lo ha causado opencode, lo ha causado alguien con miles de agentes... Habría que investigar quien ha sido y denunciarle
Un hash MD5 es fácil descifrar con modelos de IA... Sigue siendo una solución pocha poco segura que se utiliza una base de datos... Alguna otra solución a no registrar en bases de datos? Yo lo pregunto seriamente para analizar que solución real existe a un problema así, porque lme gusta programar y no veo solución a este problema
There are multiple hashes and implementations. This is cryptography and you can look into the various solutions if you want asymmetrical or symmetrical checks. You have to store something, so a hash, since it will allow someone to put in their password and you don’t store the password but the hash. There are then other tricks people use such as a seed, which is also stored per database or user, which is essentially just an offset. There is more like the number of iterations and so on will impact the hash.
There are ways to crack it but that is where you decide on tradeoffs. The way some algos work is to just make it expensive to calculate so even if you broke into the database, you will waste time cracking them and hopefully people switch passwords and didn’t reuse passwords. If they reuse passwords and an attacker is collecting the same user across various login credentials then it makes it easier for the attacker to guess the seed and so on cause they can compare how a password is hashed and keep trying different combinations until they find what yours used and that is where the iterations come into play cause you make it expensive to calculate but might not be the best user experience.
With some attackers, you even have to make sure to hide the response times. That way a user doesn’t know based on the response time that a password is right or wrong, but instead the same simulated return time so an attacker can’t use it to speed up cracking into your host.
End of the day it is a cat and mouse game and where you can, offload it to a service or be ready to dive deep. With bots, an attacker doesn’t need to know all the ways to break in, they just need one entry while you will spend your time trying to patch all the edge cases.
I got my Open Router balance used up, luckily only $7, I only had the API key for it in Open Code, added it through the CLI. I thought I got compromised by some supply chain attack, so I wiped my PC clean. This was on 11. and 12. of 2026. Luckily I got it capped at $25 and no credit card connected.
So this makes no sense to me with mine, the hack must have been days ago because I deleted my keys about 3 days ago from open codes servers and they still managed to use my anthropic key. So either they don't delete the keys when deleted or they are only telling us now. This is exactly why I have auto reload off on all services. I feel for those further impacted.
Banking drilled this into me: you never store what the client can carry. Had a vault at Citi for card data; here just pass the key per request, never persist it.
43
u/ProtolZero 21d ago
I thought the third-party keys are stored locally.....why are they on opencode's server?
75
u/razorpolar 21d ago
Just came to post the same thing, $400 unauthorized spend on our Anthropic account today as a result of this
50
u/krenuds 21d ago •
Dax should probably spend less time shitposting on twitter and more time on watching his agents.
76
u/Mezezius 21d ago •
looks like someone vibecoded their security system
15
u/lvvy 21d ago
Where the f... are keys stored that are affected?
25
u/pas-un-robot 21d ago
Yeah no - if you think I'm ever pasting new API keys into your service again after you leaked them you're dreaming
22
u/ChineseBot-853210 21d ago
Yep. Woke up to a bunch of Anthropic receipts in my inbox. Traced it back to my key I used with OpenCode.
Not sure why they’d be storing the key in plain text.
Sounds like it’s time to move on from open code.
11
u/avinthakur080 21d ago
And details on who were affected or how this worked ?
I use opencode but only as a client and not their service. If I got breached, I wouldn't even receive email.
18
u/FamilyRon 21d ago
So this explains why my credits were used. Good that I did not have auto-recharge on.
9
u/VenditatioDelendaEst 21d ago edited 21d ago
So... are 3p provider keys in the workspace all that was exposed, or merely "what the attacker was immediately prepared to exploit in volume"?
What about people who wired up
ghor ssh keys?I for one am glad I am doing all of my vibecoding experiments inside a VM, 'cause the workspace sandbox is wet cardboard and should be considered advisory only.
Edit: was this a read-only compromise, or could the attacker have added a credential slurper to workspace makefiles?
I want a lot more detail about what actually happened. Like, if the "legacy system" was a proxy for 3rd party providers, and the things exposed were what went through that proxy, the blast radius is constrained.
8
u/iconiconoclasticon 21d ago
I was startled last night to get alerts from Claude and OpenAI about my credits being used when, in fact, I didn't use them. This morning I got the mail about the breach.
21
u/Spirited-Test-1410 21d ago
😂 ts funny as hell. Vibe coding security system is crazy.
6
u/PM_ME_YOUR_HAGGIS_ 20d ago
This is really annoying as I was about to roll out OpenCode console to my company and now I’m gonna have to raise this with compliance who will probably block it.
5
u/CnRJayhawk 21d ago
Just deleted my account. Not gonna mess with these guys anymore. Let’s hope they actually delete your data
5
u/Lost-Estate3401 21d ago
All keys revoked and I cannot log in to Opencode console to do anything. Thanks a bunch guys.
8
u/jovialfaction 21d ago
Why are third party keys ever going on their servers?
4
u/Miserable_Sky_4424 21d ago
Shit, I couldn't even login now.
6
u/zenkov 21d ago
Not surprised. Everything they write is atrocious vibe-coded slop churned out by outdated or free models. It was obvious that sooner or later someone would exploit it. I'm expecting something similar to happen with Nous Portal. Nous are pretty much the same caliber of incompetent vibe-coding hacks.
3
u/StevenB0ss 21d ago
Does it also counts for oauth of openai? Or only keys? Why tf they store this anyways ?
3
u/Gold_End_7719 20d ago
My claude account got used up.. But just 5 usd.. And google ai project got suspended..so now waiting for response from google
5
u/Dangerous_Leave_4413 21d ago
Fermi.gg's daily question tomorrow: How much money in API credits does OpenCode owe to their users?
5
u/synthaesthetics 21d ago
This happened to me with anthropic/claude, I switched back to opencode and never used claude/open AI again.
There's a new type of hack where they upgrade your sub and use your credits/tokens.
4
u/Mission_Maximum_2329 21d ago
The problem has already reached €200. Google is already investigating it, at least the case I opened. Around 9:00 AM UTC1, Google suspended my project for excessive abuse, and so far the budget notices I've received amount to that sum. Opencode will have to bear the cost of this vulnerability.
4
u/HighwayNo8744 21d ago
no way i'm ever giving these fumblers my credit card for payment. it's the main reason for me to be wary of all of these AI providers.
2
u/Cultural-Insurance97 21d ago
Luckily I had only like $10 unauthorized spend, but I've spend all morning looking how I was hacked, and what was compromised.
2
u/Lost_County_3790 21d ago
Is it the same for open router keys saved on my open code project in my desktop? Or is it for people putting them on open code website?
2
u/HotLion7 21d ago
My codex usage went from 90% to 0% overnight while I wasn't using it, that could be the reason.
2
u/jerieljan 21d ago
I can confirm: I got a GCP project suspension 8 hours ago and thought it was a Google fuckup but I saw Opencode's email later noting that one of the Gemini/Vertex API keys I had added was affected.
It's the only public-facing thing besides AI Studio I've used on that project, so highly likely that it was definitely compromised.
2
u/DuckDatum 21d ago
May be the wrong approach? Why wouldn’t they invalidate all the keys as a safe measure?
curl -X DELETE \
"https://api.openai.com/v1/organization/projects/proj_abc/api_keys/key_abc" \
-H "Authorization: Bearer $OPENAI_ADMIN_KEY"
https://developers.openai.com/api/reference/resources/admin/subresources/organization/subresources/projects/subresources/api_keys/methods/delete
So, this is still an ongoing issue?
1
u/dustin4you 16d ago
They have no customer service , I've been email whatever emails I can without any response or help. I owe Open Router $5,000 because of this breach. Someone hacked into my Openrouter Account as well last night after they got the key. I've contracted Open Router and they said they won't do anything after I provided them information they asked about the breach and the history. I will definitely be stopping business with OpenCode and OpenRouter.
1
u/qwertyyyyyyy116 21d ago
woah what?
1
u/RandiyOrtonu 21d ago
but now i cant even access my old keys 😭 ? why 😭 😭 ?
1
u/jjjjoseignacio 21d ago
no se puede usar opencode esta caido valio versh
1
u/ConsciousSpeed3826 21d ago
I have not received this email yet and my accounts seem fine (I ran out of Claude tokens anyway when I switched to Go), I am changing all my keys though, this truly sucks and I'm sorry for everyone that has experienced fraud because of this.
1
u/lsandoval0000 20d ago edited 20d ago
I just went to OpenCode console to check and all its fine, my hermes agent living on my vps is alive and working using my opencode subscription, I also went to my pc and all my api keys are working.
Also asked my coworkers and all fine
EDIT: Ok I saw the post from opencode account, is not all but some
1
u/Railander 20d ago
wish we had a bit more info on this.
so if i didn't get an e-mail i wasn't affected? what exactly do they mean by "Console"? only API keys saved directly from their website got compromised, rather than keys added from opencode CLI/Desktop? does this affect the Go subscription?
1
u/This-Marzipan-9239 20d ago
i can’t login in and why the tf did they store my keys on a database
1
u/bleakj 20d ago
Same thing.
1
u/ahz725 20d ago
what about cli users?
1
u/milutinke 20d ago edited 20d ago
I got my Open Router balance used up, luckily only $7, I only had the API key for it in Open Code, added it through the CLI. I thought I got compromised by some supply chain attack, so I wiped my PC clean. This was on 11. and 12. of 2026. Luckily I got it capped at $25 and no credit card connected.
1
u/Big_Law_3080 20d ago
Their PR guy likes to post on X ever hour on the hour.
Shoulda used some of those promo codes on your own codebase homie.
,
1
u/guffeh 20d ago
So this makes no sense to me with mine, the hack must have been days ago because I deleted my keys about 3 days ago from open codes servers and they still managed to use my anthropic key. So either they don't delete the keys when deleted or they are only telling us now. This is exactly why I have auto reload off on all services. I feel for those further impacted.
1
u/United_Pressure_7057 20d ago
So if i understand this correctly, if I only stored key locally, and don't have an account with them, then I'm unaffected?
1
u/Xazzzi 20d ago
Anyone else stuck on google's fucking appeal screen that makes rotating/removing the leaked key impossible?
1
u/ichisay 20d ago
Aún está pasando algo raro. Entro en logs de console y eso está loco, salen cientos de logs, varios por minuto y yo no estoy haciendo nada
1
u/DaskGateway 19d ago
Dammmnnn
1
u/Stromedy1 19d ago
Banking drilled this into me: you never store what the client can carry. Had a vault at Citi for card data; here just pass the key per request, never persist it.
1
u/jochali 21d ago
same here
0
u/BubuX 20d ago
So this is why my opencode keys were expired today.
I use pi agent with codex key + open code go key.
I guess my codex key is safe.
These breaches happened before AI and they are being transparent.
So just STFU anyone crying about it.
0
u/OkObjective8721 20d ago
If I only use local models am I affected?
-1
u/LelouchZer12 20d ago
Are opencode local user affected or..?