On October 17, OpenCode disclosed a security breach affecting 1.4% of OpenCode Console users. Attackers had accessed a legacy system where users stored API keys for OpenAI, Anthropic, and Google.

Soon, developers reported unexpected API charges and suspended cloud projects. Some reported bills exceeding $1,000.

One important distinction: OpenCode said keys may have been exposed. Unauthorized charges were reported by users, but the full scope and attack mechanics had not been independently established.

The detail that matters most is architectural.

OpenCode’s hosted Console stores your provider keys on its side. Its command-line tool works differently: keys stay on your machine. As co-founder Dax Raad put it, “those keys never come to us.”

That is not just a product difference.
It’s a security boundary.

Your keys. Your blast radius.

Every hosted service that stores your AI credentials becomes another place where those credentials can be exposed. Convenience has a cost: you’re trusting another system with the ability to spend your money.

For engineering leaders, the answer isn’t to stop using AI agents.
It’s to make credential ownership explicit.

Four things to do this week:

• Keep keys local when possible.
  Prefer tools that call providers directly using locally stored credentials, rather than uploading keys to a hosted console.
• Use one scoped key per tool.
  Separate credentials by agent, project, and environment. Revoke one without taking everything else down.
• Set provider-level spending controls.
  Configure hard limits where supported, plus alerts well below your maximum. Alerts notify you; they don’t stop spending. Enforcement can also lag.
• Inventory every place your keys live.
  Developer machines, CI/CD, hosted agent platforms, MCP servers, dashboards, and secret stores. If you can’t name every holder, you don’t control your credentials.

OpenAI’s API key security guidance recommends secure storage, access controls, key rotation, and usage monitoring. Its spending-limit documentation explains how alerts and hard limits differ.

The bill is a security signal

Your AI usage dashboard can reveal an intrusion before a conventional security alert does. A sudden usage spike, unfamiliar model traffic, or a provider notification at 3 a.m. may be your first indication that someone else has your credentials.

But don’t confuse detection with prevention. By the time the alert arrives, the attacker may already have spent your budget. Monitor usage, enforce limits, and revoke compromised keys immediately.

This is the sequel to my September post, Your Agents Have Credentials. Nobody Owns Them.

We gave agents access to our code, infrastructure, and increasingly, our businesses. We also gave them credentials that can spend real money.

If an agent can spend your money, you need to know where its keys live, how much damage they can do, and who gets alerted when something goes wrong.

Your AI bill isn’t just a finance problem.
It’s part of your security monitoring.
Any yes – we (=EspressoLabs.com) help you with both security and monitoring and your AI agents.