Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts

OpenCode, an open-source AI coding agent, reported a security breach affecting 1.4% of users on its OpenCode Console platform. Attackers compromised an older system, potentially accessing API keys used to access AI services. This incident occurred on the same night OpenCode made GLM-5.3-Flash free for users. The GLM-5.3 family is known for its cybersecurity capabilities, approaching those of restricted-access models like Anthropic’s Claude Mythos Preview.

This report details how hackers exploited an older system, unlike the GLM-5.3 family's robust cybersecurity capabilities that approach restricted-access models.