TechCrunch reports that hackers hit the AI coding tool OpenCode and ran up charges on users' AI accounts. The incident follows earlier reporting that leaked API keys in LLM tooling expose secrets held by agents. The pattern is consistent: agent accounts typically hold provider keys with broad scope and no per-run ceiling, so a single leaked credential can be converted into spend rather than data theft.
For teams shipping agents, the implication is architectural. Key custody belongs in the runtime, not in a shared secret store that any tool can read: scoped credentials per agent and per tool, short-lived tokens issued at run time, and rotation that does not require a redeploy. Spend controls belong in the same layer — per-run and per-day ceilings, anomaly alerts on token volume, and hard cut-offs that fail closed rather than continuing to bill.
What remains unclear from the supplied coverage is the exact vector of the OpenCode compromise, the number of affected accounts, and whether provider-side controls limited the charges. Those details matter for post-incident design, but the exposure class is already visible. The studio's position is that credential scope and spend caps are agent runtime requirements, reviewed alongside tool permissions and evaluated like any other failure mode, rather than a finance concern handled after the invoice arrives.