VQV Signal
OpenCode, an open source AI coding agent, was breached by hackers who stole users' API keys and caused unauthorized charges on their AI accounts. Attempts to analyze the malicious code were blocked by the AI tools involved.
OpenCode, an open source AI coding agent, was breached by hackers who stole users' API keys and caused unauthorized charges on their AI accounts. Attempts to analyze the malicious code were blocked by the AI tools involved.
AI-assisted summary based on the listed source.
OpenCode is an open source AI coding agent that's become a popular alternative to Claude Code and Cursor. But hackers got into part of its online platform and stole some users’ API keys, and the AI tools it turned to for help kept refusing to look at the malicious code.
This incident highlights security vulnerabilities in AI coding platforms and the challenges AI tools face in detecting malicious code. It raises concerns about user data protection and the reliability of AI-based code analysis.
Security-conscious readers may want to review the source for exposure, mitigation, or practical risk details.
VQV organizes public signals from inspectable sources. It does not independently verify the underlying report.
Signal Strength reflects source quality, relevance, freshness and evidence. Public Interest helps organize discovery; it is not proof of truth.
Claude has a source-backed security with coverage spanning security.
Hackers Exploit OpenCode AI Tool, Steal API Keys and Run Up User Charges
Hackers Exploit OpenCode AI Tool, Stealing API Keys and Running Up User Charges
VQV surfaced this signal because it is recent, relevant to AI Coding Tools, connected to TechCrunch AI.
No login, cookies, social SDKs, or automatic posting.