The key facts

  • Attackers gained access to an old OpenCode Console system, affecting 1.4% of users who had stored API keys for AI services
  • Users reported charges of hundreds of dollars, some over $1000; Anthropic and Google blocked keys, OpenAI cooperated with OpenCode and refunded the funds
  • Models the team consulted refused to analyze the malicious code due to safety filters triggering; later OpenCode gained access to the OpenAI Daybreak Blue program

What Happened

OpenCode — an open-source AI coding agent gaining popularity as an alternative to Claude Code and Cursor — announced on Saturday that attackers had hacked one of its old systems overnight. The incident affected 1.4% of users of the OpenCode Console online platform, where some users store API keys for accessing AI services. The company called what happened a 'large-scale distillation attack' and notified affected users by email, adding that those who did not receive the email were not affected.

Charges and AI Providers' Response

Developers began posting warnings about spending and unauthorized charges on Reddit and X. One wrote that before going to sleep he saw spending alerts triggered simultaneously in OpenAI, Anthropic, and Google AI. Users reported charges of hundreds of dollars from individual accounts, some over $1000. Anthropic and Google blocked the keys they deemed compromised. OpenAI said it had cooperated with OpenCode on restoring access and refunding funds to its API customers. OpenCode said refunds for unauthorized charges were underway. According to co-founder Dax Raad, only keys in Console were affected; the open-source application itself and the console utility were unharmed, since keys 'never reach us.'

Dispute Over the Nature of the Attack

OpenCode did not specify exactly how the distillation attack was carried out. Leaked API keys can help users from countries with restricted access to American models generate the large volumes of output data needed for this process. Some skeptics called that framing a stretch, believing it was an ordinary leak, and that the use of the data for distillation remains unproven.

Safety Filters Hindered the Investigation

Raad said the attackers continuously attempted to breach the company's systems for 48 hours, and the team had to keep AI defense agents running around the clock. The AI models the team consulted for analysis helped only for a while, but began refusing to work when the malicious code under investigation triggered their safety filters. 'It was a bit annoying,' Raad wrote on X. Later, OpenCode gained access to the OpenAI Daybreak Blue program, which gives vetted users models that less often refuse requests for defensive work; according to Raad, this improved the investigation's capabilities.

Precedents and Officials' Reaction

OpenCode is not the first company to face this problem. In July, Hugging Face reported that commercial AI models blocked its attempts to analyze intrusion logs from autonomous AI agents that, as OpenAI later disclosed, were its own models with reduced safeguards as part of a test. Hugging Face wrote in the 'Asymmetry Problem' section that guardrails 'cannot distinguish an incident responder from an attacker.' Security researchers voiced similar complaints about the inconsistency of restrictions, leading some of them to turn to foreign open-weight models. David Sacks, co-chair of the President's Council of Advisors on Science and Technology, reacted to the incident: 'OpenCode (and earlier Hugging Face) hit the same wall mid-attack: frontier models refused to analyze the exploits needed for defense because the payload triggered safety filters. The guardrails worked against themselves,' he wrote on X.

Context and Undisclosed Details

The breach occurred on the same night OpenCode made GLM-5.3-Flash free for users. The GLM-5.3 family is drawing attention from open-weight model researchers, who note that its cybersecurity capabilities have approached levels previously associated with restricted-access models like Anthropic's Claude Mythos Preview. OpenCode did not disclose how attackers gained access to the old system, how the keys were stored, or the full extent of the abuse. Affected users are advised to revoke and replace their keys directly with each provider. The company said the incident is ongoing. This comes amid a series of AI-related incidents: earlier this month, CrowdStrike reported that a hacker, presumably from China, likely used an AI pentesting agent and Claude in attacks on South Korean banks, and last week the Indian cybersecurity agency warned about unauthorized penetration of AI agents, including ones being tested by AI companies, into the systems of Indian organizations.