OpenCode, an open-source AI coding agent that has gained prominence among developers as an alternative to Claude Code and Cursor, announced on Saturday that attackers penetrated older systems overnight, impacting 1.4% of users of its online platform, OpenCode Console. The OpenCode Console stores API keys or digital passwords that some users use to access AI services.
The rush to respond highlighted a growing problem as the OpenCode team struggled to keep up with the attacks. Companies without vetted access to less secure AI models will have a harder time defending against large-scale AI-driven cyberattacks.
“Last night we experienced a security breach related to a large-scale distillation attack that affected 1.4% of OpenCode Console users. We notified everyone via email this morning,” the company wrote on X. The company said users who did not receive the email were not affected.
The company did not say how the distillation attack occurred, but the leaked API keys could help users in countries with restricted access to U.S.-made models generate the large amount of output needed for the process. Some skeptics argued that this framework went too far, arguing that the incident was a simple violation and that its use in distillation had not yet been proven.
Overnight, developers began posting spending alerts and fraudulent charges on Reddit and X. “I saw spending alerts from Open AI, Anthropic, and Google AI going off all at once before I went to bed and wondered what was going on,” the developer wrote.
Other users reported charges of hundreds of dollars on their individual accounts. Some listed the total amount as more than $1,000.
Anthropic and Google both blocked API keys that were believed to have been exposed, but OpenAI said it worked with OpenCode to restore access and refund credits used in the attack to API customers. OpenCode said refunds for fraudulent charges are in progress.
The exposed key was limited to the console and some users were using the key in their workspace. Co-founder Dax Raad said open source apps and command line tools were not affected. “Please note that this is the OpenCode console, not OpenCode itself. These keys will never reach us,” he wrote on X.
Even as users and AI companies moved to disable the exposed keys, the OpenCode team remained under pressure. Lard said attackers have been trying to break into systems nonstop for 48 hours, and the team needs to keep AI defense agents running 24 hours a day. The AI models that the OpenCode team used for analysis were useful for a while, but they started to break down when the malicious code they were asked to investigate activated safety filters.
“(T)hat was a little irritating,” he wrote to X.
OpenCode then gained access to OpenAI’s Daybreak Blue program. This provides a vetted AI model of users that is less likely to deny requests for defensive security work. Lard said the access improved the team’s ability to investigate the attack.
OpenCode is not the first company to hit this wall. In July, AI platform Hugging Face announced that its commercial AI model had thwarted an attempt by an autonomous AI agent to analyze activity logs from an intrusion, but OpenAI later revealed that its own model was running with safeguards lowered during the test. In a section of the blog post titled “The Problem of Asymmetry,” Hugging Face writes that guardrails “cannot distinguish between incident responders and attackers.”
Security researchers have raised similar complaints, saying the restrictions are inconsistent and in part promote a foreign model of indiscriminate use that anyone can download and run.
This weekend’s episode drew a response from David Sachs, co-chair of the President’s Council of Advisors on Science and Technology.
“OpenCode (and early Hugging Face) also hit the same wall during the attack. Because the payload triggered the safety filter, the frontier model refused to analyze the very exploit needed to defend. The guardrails backfired,” he wrote to X.
This breach occurred on the same night that OpenCode made GLM-5.3-Flash free to users. The broader GLM-5.3 family has received attention from researchers who study open-weight models and note that their cybersecurity capabilities approach levels previously associated with restricted-access models like Anthropic’s Claude Mythos Preview.
OpenCode did not detail how the attackers gained access to the old systems, how the keys were stored, or the full scope of the exploit. We have instructed affected users to revoke and replace their keys directly with each provider. The company said the case is still ongoing.
The breach comes amid a spate of AI-powered cyber incidents. Cybersecurity firm CrowdStrike announced earlier this month that China-based hackers likely used Claude, an AI penetration testing agent that probes computer systems for weaknesses, in an attack on a South Korean bank. Indian cybersecurity officials warned last week that AI agents, including some being tested by AI companies, had infiltrated the systems of Indian organizations without authorization.
If you make a purchase through links in our articles, we may earn a small commission. This does not affect editorial independence.
