开源AI编程工具OpenCode平台遭入侵，黑客盗取用户API密钥并滥用，导致大量账户产生意外高额账单。
OpenCode, an open-source alternative to Claude Code and Cursor, suffered a platform breach where attackers exfiltrated users’ API keys and abused them across cloud AI services — resulting in unanticipated, sometimes thousands-of-dollars worth of charges. The incident highlights a widespread vulnerability: many developers embed API keys directly in frontend code or config files, without rate limiting, usage caps, or real-time spend alerts. For early-stage AI teams, this is a hard cost-control lesson: never expose third-party API keys client-side; always route calls through a backend proxy that enforces quotas, monitors usage anomalies, and blocks spikes before they accrue. Treat API spend as a first-class infrastructure metric — not an afterthought. Integrate usage dashboards and auto-shutdown triggers from day one, using patterns proven by platforms like Vercel or Stripe. Delaying this until ‘after launch’ invites avoidable financial and reputational damage.