ㅤ
The October 16 attack targeted OpenCode Console, which manages users’ AI provider credentials. According to TechCrunch, affected users reported unauthorized AI usage charges ranging from hundreds to more than $1,000. OpenCode described the incident as a large-scale AI model distillation attack.
ㅤ
OpenCode notified affected users on October 17, advised them to revoke and replace their API keys, and contacted OpenAI, Anthropic and Google. The company has not disclosed how attackers gained access.
ㅤ
An expert with BreachLock offers perspective on the matter.
ㅤ
Seemant Sehgal, Founder & CEO, BreachLock:
ㅤ
“When a single AI developer tool holds API keys for OpenAI, Anthropic, and Google, breaking into that tool gives an attacker immediate billing access against three of the largest frontier model providers at once. That is why some users saw fraud charges reach the four figures before the breach was even disclosed.”
ㅤ
“For organizations using any AI coding platform, provider credentials need the same rotation discipline as production database passwords, with per-project keys and spending caps set at the provider level so one compromised tool does not translate into unlimited usage against every account the organization owns. Pentesting the AI tool chain itself, specifically what a compromised developer tool could reach and spend before detection, is a test worth adding to the regular rotation.”
20 October 2026
DHS bans DeepSeek AI products across federal civilian agencies
The Department of Homeland Security has ordered federal civilian agencies to remove Chinese AI (…)
