Saved your AI API key in a coding tool? A breach is a reminder to protect it like a password
What happened: On the night of 16 October 2026, an intruder got into an old system at OpenCode, an AI coding tool. OpenCode’s optional online Console stores a team’s API keys for OpenAI, Anthropic or Google so team members can use AI models without seeing the key. The company says those saved keys may have been exposed for about 1.4% of Console users, and emailed them on 17 October asking them to replace their keys.
Some users said they saw charges they didn’t make on their AI accounts, from about $168 to $1,700. OpenCode hasn’t confirmed that any key was copied or used. Keys kept only in its command-line and desktop apps stay on your own computer and weren’t affected.
Why it matters for you: An API key is like a password plus a credit card for an AI service. Anyone who has it can run the AI and send you the bill. Students and beginners often paste keys into apps, websites and code they share on GitHub.
What to do if you use AI API keys:
- Revoke and replace any key you’ve saved in a third-party tool you’re unsure about. Deleting it from the tool doesn’t cancel it: do it in the AI company’s own dashboard.
- Set a spending limit and billing alerts on every AI account.
- Use a separate key for each app, so one leak doesn’t expose everything.
- Never paste keys into public code, chats, screenshots or AI prompts.
- Check your usage page now and then for activity you don’t recognise.
New to this? Our glossary explains API and other terms in one line.