OpenCode, an open-source artificial intelligence coding agent, said attackers had breached an older system, affecting 1.4% of users of its online platform, OpenCode Console, where some customers store application programming interface (API) keys used to access AI services.
The company disclosed the incident on Saturday, saying affected users had been notified by email. Those who did not receive an email were not affected, it said. The breach prompted reports of unauthorised spending on AI services and a scramble by OpenCode and major AI providers to disable exposed credentials and reimburse customers.
The incident also highlighted a growing challenge for cybersecurity teams: commercial AI models with strict safety restrictions can refuse to analyse malicious code even when investigators need to examine it to defend against an attack.
OpenCode described the breach as a “large-scale distillation attack”, referring to a process in which outputs from an AI model can be used to develop or improve another model. However, the company did not explain how the attack occurred, and some observers disputed whether the available evidence supported that characterisation, arguing that the incident was a conventional security breach and that the alleged use of stolen credentials for model distillation remained unproven.
Developers began reporting spending alerts and unauthorised charges on Reddit and X overnight. One user wrote that alerts for spending on OpenAI, Anthropic and Google AI services had all arrived before they went to bed. Other users reported individual account charges running into hundreds of dollars, with some describing totals exceeding $1,000.
Anthropic and Google blocked API keys they believed had been exposed. OpenAI said it worked with OpenCode to restore access and refund customers for API credits consumed during the attack. OpenCode separately said refunds for unauthorised charges were under way.
OpenCode co-founder Dax Raad stressed that the breach was confined to Console, rather than the company’s open-source application and command-line tool. The exposed keys were stored in some users’ Console workspaces. “Note this is the OpenCode Console, not OpenCode itself, those keys never come to us,” Raad wrote on X.
The company’s response was complicated by continued attempts to penetrate its systems. Raad said attackers had been trying to break in continuously for 48 hours, forcing the team to run AI-powered defensive agents around the clock. Models used to analyse the incident initially helped but subsequently refused to examine malicious code when it triggered their safety filters. “That was a bit frustrating,” he wrote.
OpenCode later gained access to OpenAI’s Daybreak Blue programme, which provides vetted users with AI models less likely to refuse requests involving defensive security work. Raad said the access improved the team’s ability to investigate the attack.
The difficulty resembles an incident reported in July by AI platform Hugging Face, which said commercial models had blocked attempts to analyse activity logs from an intrusion involving autonomous AI agents. OpenAI later disclosed that its own models had been involved in the activity during a test in which their safeguards had been lowered. Hugging Face argued that safety systems “cannot distinguish an incident responder from an attacker”.
David Sacks, co-chair of the President’s Council of Advisors on Science and Technology, criticised the restrictions following the OpenCode breach. “The guardrails backfired,” he wrote on X, referring to frontier models refusing to analyse exploits needed for defence because the code triggered safety filters.
OpenCode has not disclosed how attackers accessed the older system, how the keys were stored or the full extent of their misuse. It has urged affected users to revoke and replace their keys directly with each service provider and said the incident remains ongoing.
The breach occurred on the same night OpenCode made GLM-5.3-Flash free to users. Earlier this month, CrowdStrike said a China-based hacker had likely used an AI penetration-testing agent and Claude in attacks on South Korean banks. Last week, India’s cybersecurity agency warned that AI agents had accessed systems belonging to Indian organisations without authorisation.
