OpenCode, an open source AI coding agent, said Saturday that attackers broke into one of its older systems overnight. The breach affected 1.4% of users of OpenCode Console, its online platform.
Some Console users store API keys there. These keys work like digital passwords that let people access AI services.
“We had a security breach last night related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users,” the company wrote on X. All affected users were notified by email, and those who did not get one were not impacted.
Users Report Unauthorized Charges
Overnight, developers began posting spending alerts and unexpected charges on Reddit and X. One developer said alerts from OpenAI, Anthropic, and Google all went off before bed.
Other users reported charges in the hundreds of dollars on single accounts. A few said their totals were above $1,000.
Anthropic and Google blocked the API keys they believed were exposed. OpenAI said it worked with OpenCode to restore access and refund API customers for credits used in the attack.
OpenCode said refunds for unauthorized charges are underway. Co-founder Dax Raad said only the Console was affected, not the open source app or command-line tool.
“Note this is the OpenCode Console, not OpenCode itself, those keys never come to us,” Raad wrote on X. OpenCode has been gaining ground as an alternative to Claude Code and Cursor.
OpenCode did not explain how the distillation attack happened. Leaked API keys can help users in countries with limited access to American AI models create the large volume of outputs needed for distillation.
Some skeptics said the incident was a simple breach. They argued any use for distillation has not been proven.
AI Safety Filters Slowed the Response
Raad said attackers tried to break into OpenCode’s systems nonstop for 48 hours. The team kept AI defensive agents running around the clock.
AI models the team used for analysis helped at first. They later refused to work when the malicious code they reviewed set off safety filters. “[T]hat was a bit frustrating,” Raad wrote.
OpenCode later gained access to OpenAI’s Daybreak Blue program, which gives vetted users AI models less likely to refuse defensive security work. Raad said the access improved the investigation.
In July, Hugging Face said commercial AI models blocked its efforts to review logs from an intrusion by autonomous AI agents. OpenAI later said those agents were its own models running with lowered safeguards during a test.
David Sacks, co-chair of the President’s Council of Advisors on Science and Technology, responded on X. “The guardrails backfired,” he wrote.
The breach happened the same night OpenCode made GLM-5.3-Flash free for users. Researchers have said the GLM-5.3 family’s cybersecurity skills approached those of restricted models like Anthropic’s Claude Mythos Preview.
Earlier this month, CrowdStrike said a China-based hacker likely used an AI penetration-testing agent and Claude in attacks on South Korean banks. Last week, India’s cybersecurity agency warned that AI agents had reached Indian organizations’ systems without authorization.
OpenCode has not said how attackers entered the older system or how keys were stored. It has told affected users to revoke and replace their keys with each provider. The company said the incident remains ongoing.
