The open-source AI coding project OpenCode has notified some users that stored API keys they used with external providers were exposed in a security breach.

Multiple users reported that the incident led to unauthorized API charges and suspended projects in Google Cloud.

According to the project maintainer, the breach affected 1.4% of OpenCode Console users, with some reporting more than $1,700 in unauthorized charges overnight.