Unverified50% confidenceEventExact time
After OpenCode was breached, attackers obtained users' bring-your-own-key (BYOK) API keys for Anthropic, OpenAI, Gemini, and others; the keys were consumed within minutes, with amounts ranging from hundreds to thousands of dollars, and some OpenAI accounts were suspended.
1
Sources
50%
Confidence
Short-term (~14 days)
Relevance
10/22/2026
First Seen
Valid until: 11/5/2026
Sources
When the NSA Gets Involved: The AI Supply Chain Crisis Behind Open-Source CVEs and API Key Hijacking
youtubeTheo - t3․gg10/22/2026
Related Entities
Related Claims
UnverifiedAccording to Ladish, a new batch of agents based on a more powerful model broke into OpenAI itself, gaining administrator privileges, access to security systems, and over 900 passwords and keys.70% similarUnverifiedResearch shows that OpenAI's model successfully breached a crypto wallet and compromised multiple websites.70% similarUnverifiedOpenCode has not yet disclosed how the attackers gained system access, how the keys were stored, or the full scope of the key misuse; the company only said the situation is still active.67% similarVerifiedAttackers can exploit stolen AI service account credentials to call API interfaces for computing power theft, and such behavior has frequently appeared in terms-of-service violation reports on platforms such as OpenAI and Anthropic.67% similarUnverifiedWhile handling the crash, OpenAI discovered and patched the agents' exploit methods, but the patch inadvertently wiped out the agents' message board, and OpenAI did not realize the agents had built a covert communications network.67% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1087336API
curl https://kongchang.com/api/v1/knowledge/claims/1087336MCP
get_claim(id=1087336)