OpenCode, an open source AI coding agent, confirmed a security breach that compromised the accounts of 1.4 percent of its online platform users. The incident, which occurred overnight, allowed attackers to steal API keys and run up unauthorized charges on users’ accounts with major AI providers including OpenAI, Anthropic, and Google.
The breach targeted the OpenCode Console, a web-based interface where some developers store the digital credentials needed to access AI models. The core open source application and command-line tool were not affected, according to co-founder Dax Raad. He emphasized that the exposed keys never left the console environment to reach OpenCode’s own servers.
Unauthorized Charges and Provider Response
Developers began reporting spending alerts on social media platforms and forums shortly after the attack began. One user noted that notifications from OpenAI, Anthropic, and Google fired off simultaneously while they were sleeping. Other reports detailed unauthorized charges ranging from hundreds to over $1,000 on individual accounts.
AI providers moved quickly to contain the damage. Anthropic and Google blocked the compromised API keys, while OpenAI worked with OpenCode to restore access and refund credits used during the attack. OpenCode stated that refunds for unauthorized charges are currently underway. The company notified all affected users via email, noting that those who did not receive a message were not impacted.
Security researchers have questioned the company’s initial characterization of the event as a “distillation attack.” While leaked keys can facilitate the generation of large volumes of AI outputs for training other models, some experts argue the incident was a straightforward credential theft with unproven secondary motives.
AI Guardrails Hinder Defense Efforts
The breach highlighted a growing challenge for cybersecurity teams: commercial AI models often refuse to analyze malicious code due to built-in safety filters. As OpenCode engineers worked to identify the intrusion vector, their own AI defensive agents began refusing requests to examine the malicious payloads. The models triggered safety protocols when asked to process the exploit code, effectively blinding the defense team.
OpenCode eventually gained access to OpenAI’s Daybreak Blue program, which provides vetted users with models that have fewer restrictions on defensive security work. This access improved the team’s ability to investigate the attack, which had been ongoing for 48 hours prior to the console breach.
This issue mirrors a problem previously identified by Hugging Face, which reported that commercial AI models blocked its attempts to analyze logs from an intrusion by autonomous AI agents. David Sacks, co-chair of the President’s Council of Advisors on Science and Technology, noted on X that frontier models frequently refuse to analyze the very exploits needed for defense because the payloads trip safety filters.
Security researchers have raised similar complaints about inconsistent restrictions, pushing some organizations toward foreign open-weight models that can be downloaded and run locally without such guardrails. The OpenCode incident occurred the same night the company made GLM-5.3-Flash free for users, a model whose cybersecurity capabilities have drawn attention from researchers studying open-weight systems.
OpenCode has not disclosed how attackers initially accessed the older system or the full extent of the misuse. The company has advised affected users to revoke and replace their keys directly with each provider. The incident remains ongoing as the team continues to investigate the breach.
Source: TechCrunch
