Hackers breach OpenCode platform, steal API keys and run up charges

Hackers got into part of the open-source AI coding agent OpenCode's online platform and stole some users' API keys, running up charges on their AI accounts. The AI tools the team turned to for help kept refusing to inspect the malicious code.

Why it matters: Coding-agent platforms hold keys to expensive model accounts, making them high-value targets. The refusals during incident response show safety filters can hamper defenders, a trade-off labs have yet to resolve.