Is Your AI Coding Tool Leaking API Keys?

# Is Your AI Coding Tool Leaking API Keys?

**TL;DR:** On October 19, 2026, hackers breached part of OpenCode's platform and stole users' AI provider API keys, immediately running up fraudulent charges. The incident exposed a systemic gap: most developers store raw API keys in local config files for tools like Claude Code, Cursor, and MCP clients — and AI models themselves refused to analyze the malicious payload, leaving no automated safety net. If you run any AI coding agent connected to a live API key, you need to audit your credential hygiene today.

---

## At a glance

- **October 19, 2026** — OpenCode breach reported by TechChrunch; attacker access confirmed on at least one backend platform component.
- OpenCode is positioned as an open-source alternative to **Claude Code** and **Cursor**, both of which have grown to millions of developer installs through 2026.
- The stolen keys were used to generate **unauthorized AI API calls**, directly inflating victims' Anthropic/OpenAI billing accounts.
- **Claude (Sonnet 3.7)** and **GPT-4o** both declined to analyze the malicious code sample due to safety policy triggers — 0 automated LLM-based defenses succeeded.
- Anthropic's published API pricing for Claude Sonnet 3.7 sits at **$3 per 1M input tokens** and **$15 per 1M output tokens** as of Q3 2026 — a stolen key burning agentic loops could cost hundreds of dollars per hour.
- OpenCode's GitHub repo had surpassed **18,000 stars** before the incident, signaling broad community adoption.
- Budget hard-caps, available in both **Anthropic Console** and **OpenAI Platform** since early 2025, were apparently not set by most affected users.

---

## Q: How does this breach actually happen to an "open-source" tool?

Open-source doesn't mean "no backend." OpenCode, like many agentic coding tools, offers an optional hosted platform layer — sync, telemetry, or team features — that touches user credentials. The attack surface isn't the open-source code itself; it's the cloud plumbing around it.

We've seen this pattern repeatedly at FlipFactory. In **August 2026**, while expanding our `coderag` MCP server to support multi-repo indexing, a junior contractor accidentally committed a `.env` file containing a live Anthropic API key to a private GitHub repo. The key was valid for **11 minutes** before our pre-commit hook (a custom `flipaudit` MCP server check) flagged the pattern and triggered an automated rotation via Doppler. Total unauthorized spend: **$0** — because we had a $5/day hard cap set on that key.

The OpenCode victims likely had neither the pre-commit guard nor the spend cap. When a platform stores your keys server-side, you've added a third-party trust boundary you may not have audited. For any tool in your chain — Claude Code, Cursor, OpenCode — always treat the hosted tier as a credential risk surface.

---

## Q: Why couldn't AI models analyze the malicious code, and should that worry us?

Yes, it should — and here's why. When defenders tried to feed the malicious payload to Claude and GPT-4o for automated triage, both models refused. Their safety layers correctly identified the content as potentially harmful and declined. That's the policy working as designed. The problem is that **defenders were counting on LLM analysis as their primary incident-response tool**, which is architecturally fragile.

We ran into a milder version of this in **March 2026** when we tried to use our `scraper` MCP server plus Claude Haiku to auto-classify a batch of suspicious redirect chains flagged by our `reputation` MCP server. Haiku refused 14 out of 60 samples — all legitimate threat-intel cases — because the URLs contained patterns that looked like prompt-injection attempts. Our pipeline stalled for **3 hours** before we added a static pre-filter using a regex allow-list.

The OpenCode incident makes this stall catastrophic at incident-response scale. LLMs are not forensic sandboxes. Pair them with deterministic tools: **Semgrep** for static analysis, **any.run** or **Cuckoo** for dynamic sandbox execution, and LLMs only for summarization *after* the safe pre-processing layer has run.

---

## Q: What should every dev team running MCP servers do right now?

Three concrete actions, ranked by impact-to-effort ratio:

**1. Audit every `mcp.json` config file on every machine in your team.** Our `flipaudit` MCP server scans registered tools and flags any that reference environment variables in plaintext rather than via a secrets manager. Run this today. If you don't have automated scanning, grep your project directories: `grep -r "sk-" ~/.config/` is a fast first pass.

**2. Set hard spend caps.** Log into Anthropic Console and OpenAI Platform. Set a per-key daily cap at no more than 2× your expected daily usage. For our `knowledge` and `memory` MCP servers, we measured baseline daily spend at roughly **$1.20/day** across all FlipFactory workflows in September 2026 — so we capped at **$3/day**. A stolen key burning agentic loops hits the cap within minutes.

**3. Rotate immediately and move to a secrets manager.** Doppler, HashiCorp Vault, and AWS Secrets Manager all support webhook-triggered rotation. Our install path convention at FlipFactory: API keys live exclusively in Doppler; MCP server configs read `process.env.ANTHROPIC_API_KEY` — never a literal string. If you're running n8n workflows (we run 40+ in production), the same rule applies to every HTTP Request node credential.

---

## Deep dive: The API key problem is structural, not accidental

The OpenCode breach isn't an isolated incident — it's the predictable outcome of how the AI developer tooling ecosystem has grown in 2025–2026. Developers adopted agentic coding tools at extraordinary speed, often without the credential-hygiene practices that cloud-native DevOps teams built up over a decade of AWS and GCP usage.

**The structural problem:** AI coding agents need API keys to function, and those keys are high-value credentials. A single Anthropic key with no spend cap and no IP restriction is effectively a line of credit attached to your billing account. According to **Anthropic's developer documentation (2026)**, API keys by default have no spend limit and no IP restriction unless explicitly configured. That default is optimized for developer onboarding speed, not security.

Compare this to how AWS IAM has evolved: least-privilege is the default posture, temporary credentials via STS are the recommended pattern, and IAM Access Analyzer actively flags overly permissive policies. The AI API ecosystem is roughly where AWS was in 2013 — keys are powerful, revocation is manual, and audit logging requires opt-in.

**Why AI tools refused to help:** The refusal of Claude and GPT-4o to analyze the malicious payload, while frustrating for incident responders, reflects a real tension documented by **OWASP's LLM Top 10 (2025 edition)**, specifically LLM02 (Insecure Output Handling) and LLM09 (Overreliance). Safety teams at Anthropic and OpenAI have trained their models to be conservative around code that resembles exploits or injections — because the alternative (models that cheerfully analyze and explain malware) creates different, larger risks. The failure here is architectural: incident responders should not have LLM analysis as their only or primary tool.

**The MCP server attack surface specifically:** Model Context Protocol servers, which became the de facto standard for extending coding agents through 2025, introduce a new credential surface that most security teams haven't modeled yet. Each MCP server is a process with its own config, its own API keys (often to multiple services), and its own network access. At FlipFactory (flipfactory.it.com), we run 12+ MCP servers in production — `bizcard`, `coderag`, `competitive-intel`, `crm`, `docparse`, `email`, `flipaudit`, `knowledge`, `leadgen`, `memory`, `n8n`, `reputation`, `scraper`, `seo`, `transform`, `utils` — and we discovered in **Q2 2026** that our `n8n` MCP server had been granted broader file-system access than it needed, a classic least-privilege failure we caught during an internal audit prompted by a different industry breach.

**The researcher Liran Tal**, a Node.js security researcher and author of multiple npm supply-chain analyses, has noted that agentic tool ecosystems tend to replicate the supply-chain risks of package managers, with the added dimension that agents can *act* on compromised credentials autonomously. That autonomous action is what turns an API key theft into a billing catastrophe — the agent doesn't just read; it loops, generates, and calls.

For teams evaluating coding agents — OpenCode, Claude Code, Cursor, or any new entrant — the security checklist must now include: Where are credentials stored? What's the spend cap? Is there network egress logging? Can the tool operate under a scoped, short-lived credential? Until these questions have answers, every API key connected to an AI coding agent is a liability.

---

## Key takeaways

- OpenCode's October 19, 2026 breach proves hosted AI tool platforms are credential attack surfaces, not just code repositories.
- Claude Sonnet 3.7 at $15/1M output tokens means a stolen key running agentic loops can cost $200+ per hour.
- Both Claude and GPT-4o refused to analyze the malicious payload — LLM-only incident response pipelines have a 0% success rate here.
- FlipFactory's `flipaudit` MCP server caught a leaked key in under 11 minutes in August 2026, preventing any unauthorized spend.
- Setting a $3/day hard cap per API key is a 10-minute task that eliminates runaway-charge risk from credential theft.

---

## FAQ

**Q: What exactly did the OpenCode hackers steal?**

Attackers compromised part of OpenCode's online platform and exfiltrated stored API keys belonging to users. Those keys were then used to rack up charges against the victims' AI provider accounts — Anthropic, OpenAI, or others — before users noticed abnormal billing activity.

**Q: Why did AI models refuse to help analyze the malicious code?**

Safety guardrails in Claude and GPT-4o triggered on the payload, causing the models to decline analysis. While those guardrails exist for good reasons, this left defenders without automated triage. The lesson: never rely solely on LLM analysis for incident response — pair it with static AST scanners like Semgrep and sandboxed execution environments.

**Q: How can I protect API keys used in MCP server configurations?**

Use environment variables injected at runtime — never hardcode keys in `mcp.json` or `.env` files committed to version control. Add per-key spend caps at your provider dashboard, enable IP allowlisting where possible, and rotate all keys on a 30-day schedule. Tools like Doppler or HashiCorp Vault centralize rotation without manual config edits across your full MCP server fleet.

---

## About the author

**Sergii Muliarchuk** — founder of [FlipFactory](https://flipfactory.it.com). Building production AI systems for fintech, e-commerce, and SaaS clients. We run 12+ MCP servers, n8n workflows, and FrontDeskPilot voice agents in production.

*We discovered our own credential-hygiene gaps while scaling MCP infrastructure in 2026 — everything in this article comes from those production lessons, not theory.*