OpenCode, an open source AI coding agent, said attackers broke into one of its older systems overnight on Saturday. The breach affected 1.4% of users of OpenCode Console, its online platform.
Some Console users store API keys there. These keys act like digital passwords for AI services.
“We had a security breach last night related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users,” the company wrote on X. It said affected users were notified by email.
Developers Report Unexpected AI Charges
Overnight, developers posted spending alerts and unauthorized charges on Reddit and X. One said alerts from OpenAI, Anthropic, and Google all went off before bed.
Other users reported charges in the hundreds of dollars on single accounts. A few said their totals topped $1,000.
Anthropic and Google blocked the API keys they believed were exposed. OpenAI said it worked with OpenCode to restore access and refund its API customers.
OpenCode said refunds for unauthorized charges are underway. It has not shared the full extent of any misuse.
Co-founder Dax Raad said the exposed keys were limited to Console. The open source app and command-line tool were not affected. “Note this is the OpenCode Console, not OpenCode itself, those keys never come to us,” he wrote on X.
OpenCode did not explain how the distillation attack happened. Leaked keys can help users in countries with limited access to American AI models generate the high volume of outputs distillation needs. Some critics said the distillation link has not been proven.
AI Safety Filters Slowed the Response
Raad said attackers had tried to break into OpenCode’s systems nonstop for 48 hours. The team kept AI defensive agents running around the clock.
The AI models the team used for analysis helped at first. They later refused to work when the malicious code they examined set off safety filters. “[T]hat was a bit frustrating,” Raad wrote.
OpenCode then gained access to OpenAI’s Daybreak Blue program, which gives vetted users models less likely to refuse defensive security work. Raad said this improved the investigation.
In July, Hugging Face said commercial AI models blocked it from analyzing an intrusion by autonomous AI agents. OpenAI later said those were its own models, tested with lowered safeguards.
David Sacks, co-chair of the President’s Council of Advisors on Science and Technology, pointed to both cases on X. “The guardrails backfired,” he wrote.
The breach came the same night OpenCode made GLM-5.3-Flash free for users. Researchers have said the GLM-5.3 family’s cybersecurity skills neared those of restricted models like Anthropic’s Claude Mythos Preview.
Earlier this month, CrowdStrike said a China-based hacker likely used an AI penetration-testing agent and Claude in attacks on South Korean banks. Last week, India’s cybersecurity agency warned that AI agents had reached Indian organizations’ systems without permission.
OpenCode has not said how attackers got into the older system or how keys were stored. It has told affected users to revoke and replace their keys with each provider. The company said the incident remains ongoing.
