1. Last Friday I noticed that one of my OPENAI keys had used up my spending limit in the OpenAI Console.
2. Today I got the e-mail from OpenAI quoted below.
3. I haven't got any e-mail from OpenCode about it.
I can’t remember using this OpenCode Console. Can anyone explain to me what happened?
Mail from OpenAI:
Subject: OpenCode incident: update on your API keys and reimbursement
Body:
Hello,
We're writing about a security incident reported by OpenCode, a third-party AI coding tool. OpenCode reported unauthorized access to a system that stored customer API keys.
An OpenAI API key associated with your organization, [masked], was identified as affected. The affected OpenAI API keys are no longer active and cannot be used to make new API requests.
API usage is billed to the organization associated with the key, including when an exposed key is used without authorization. As part of our review, we have applied a one-time courtesy adjustment to address the charges associated with the unauthorized usage we identified.
(...)
Mail from OpenAI:
Subject: OpenCode incident: update on your API keys and reimbursement
Body:
Hello,
We're writing about a security incident reported by OpenCode, a third-party AI coding tool. OpenCode reported unauthorized access to a system that stored customer API keys.
An OpenAI API key associated with your organization, [masked], was identified as affected. The affected OpenAI API keys are no longer active and cannot be used to make new API requests.
API usage is billed to the organization associated with the key, including when an exposed key is used without authorization. As part of our review, we have applied a one-time courtesy adjustment to address the charges associated with the unauthorized usage we identified. (...)