OpenCode Console Security Breach Exposes API Keys, Driving Unauthorized AI Charges

OpenCode, an open-source AI coding agent gaining traction among developers as an alternative to Claude Code and Cursor, disclosed on Saturday that attackers compromised an older system overnight. The incident affected approximately 1.4% of users on OpenCode Console, the company’s online platform where some customers store API keys used to access AI services.

As OpenCode scrambled to contain the intrusion, the response underscored a broader industry challenge: organizations lacking vetted access to AI models with fewer safety restrictions struggle to defend against large-scale, AI-driven cyberattacks.

“We experienced a security breach last night tied to a large-scale distillation attack affecting 1.4% of OpenCode Console users,” the company stated on X. “All affected users were notified by email this morning.” The company added that users who did not receive a notification were not impacted.

OpenCode did not detail how the distillation attack was carried out. However, exposed API keys could enable users in regions with restricted access to American AI models to generate the high output volumes required for distillation. Some critics characterized the description as an overreach, contending that the incident appeared to be a standard breach with no confirmed link to distillation.

Overnight, developers took to Reddit and X to report spending alerts and unauthorized charges. “I saw my OpenAI, Anthropic, and Google AI spend alerts all trigger before going to bed, wondering what was happening,” one developer wrote.

Other users reported charges in the hundreds of dollars on individual accounts, with a few citing totals exceeding $1,000.

Anthropic and Google blocked the API keys they believed were compromised, while OpenAI collaborated with OpenCode to restore access and refund API customers for credits consumed during the attack. OpenCode said reimbursements for unauthorized charges are in progress.

The exposed keys were limited to OpenCode Console workspaces; the open-source desktop application and command-line tool were unaffected, according to co-founder Dax Raad. “Note this is OpenCode Console, not OpenCode itself—those keys never reach us,” he wrote on X.

Even as users and AI providers moved to disable exposed keys, OpenCode’s engineering team remained under sustained pressure. Raad said attackers attempted to penetrate its systems continuously for 48 hours, forcing the team to operate AI defensive agents around the clock. The models used for analysis initially assisted, but began refusing requests when the malicious code under review triggered safety filters.

“[T]hat was a bit frustrating,” Raad wrote on X.

OpenCode later gained access to OpenAI’s Daybreak Blue program, which provides vetted users with AI models less likely to decline requests for defensive security tasks. Raad said the access improved the team’s ability to investigate the breach.

OpenCode is not the first company to encounter this obstacle. In July, AI platform Hugging Face reported that commercial AI models blocked its efforts to analyze activity logs from an intrusion by autonomous AI agents—later revealed by OpenAI to be its own models operating with lowered safeguards during a test. In a blog post section titled “The asymmetry problem,” Hugging Face noted that guardrails “cannot distinguish an incident responder from an attacker.”

Security researchers have voiced similar concerns, arguing that restrictions are inconsistent and have driven some users toward foreign open-weight models that can be downloaded and run locally.

The weekend incident prompted a response from David Sacks, co-chair of the President’s Council of Advisors on Science and Technology.

“OpenCode—and earlier Hugging Face—hit the same wall mid-attack: frontier models refused to analyze the very exploits needed for defense because the payloads tripped safety filters. The guardrails backfired,” he wrote on X.

The breach occurred the same night OpenCode made GLM-5.3-Flash available to users at no cost. The broader GLM-5.3 family has attracted attention from researchers studying open-weight models, who note that its cybersecurity capabilities approach levels previously associated with restricted-access systems such as Anthropic’s Claude Mythos Preview.

OpenCode has not disclosed how attackers accessed the older system, how keys were stored, or the full extent of any misuse. The company has instructed affected users to revoke and replace their keys directly with each provider and stated that the incident remains ongoing.

The breach follows a series of AI-enabled cyber incidents. Earlier this month, cybersecurity firm CrowdStrike said a China-based hacker likely used an AI penetration-testing agent and Claude to target South Korean banks. Last week, India’s cybersecurity agency warned that AI agents, including some being tested by AI companies, had accessed Indian organizations’ systems without authorization.

Source link