OpenCode, an open-source AI coding agent positioned as an alternative to Claude Code and Cursor, said on Saturday that attackers broke into an older system overnight, affecting 1.4% of users on its online platform, OpenCode Console. The Console is where some users store API keys — the digital credentials used to access AI services — and those keys may have been exposed.
Scope and immediate effects
OpenCode posted on X that it experienced “a security breach last night related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users,” and that it emailed all affected users that morning. The company said users who did not receive an email were not impacted.
Following the incident, developers began reporting spending alerts and unauthorized charges on Reddit and X. Some users reported individual charges in the hundreds of dollars, and a few said totals exceeded $1,000.
Actions by AI providers and OpenCode
Anthropic and Google blocked API keys they believed had been exposed. OpenAI said it worked with OpenCode to restore access and refund its API customers for credits consumed during the attack. OpenCode stated that refunds for unauthorized charges are in progress.
Co-founder Dax Raad clarified on X that the exposed keys were limited to the Console, and that the open-source app and command-line tool were not affected: “this is the OpenCode Console, not OpenCode itself, those keys never come to us.”
Distillation claims and skepticism
OpenCode described the incident as involving a distillation-style attack but did not provide technical details of how the attack was executed. Observers noted that leaked API keys can be used to generate the high volume of outputs required for model distillation, particularly from locations with restricted access to U.S. models. Other commentators argued the framing may be overstated and that the event could be an ordinary breach without proven use for distillation.
Incident response, model safety filters, and limits
Raad said attackers had been trying to breach OpenCode systems continuously for 48 hours, forcing the team to run AI defensive agents around the clock. Initially, some AI models helped with analysis, but later refused to process the malicious code when safety filters were triggered, hampering investigation.
OpenCode later gained access to OpenAI’s Daybreak Blue program, which provides vetted users with models less likely to refuse requests needed for defensive security work. Raad said that access improved the team’s investigative capabilities.
This problem is not unique to OpenCode. In July, Hugging Face reported that commercial AI models declined to analyze activity logs during an intrusion investigation; that incident later involved OpenAI models running with safeguards lowered in a test. Critics and security researchers have argued that guardrails can’t reliably distinguish benign incident response from malicious use, pushing some defenders toward open-weight models that can be run locally.
David Sacks, co-chair of the President’s Council of Advisors on Science and Technology, commented that frontier models sometimes refuse to analyze exploits needed for defense, calling the guardrails counterproductive.
Context and remaining unknowns
The breach occurred on the same night OpenCode made GLM-5.3-Flash free for users. The GLM-5.3 family has drawn attention from researchers studying open-weight models, who have noted that its cybersecurity capabilities approach those of restricted-access models such as Anthropic’s Claude Mythos Preview.
OpenCode has not disclosed specifics about how attackers accessed the older system, how keys were stored, or the full extent of misuse. The company has advised affected users to revoke and replace keys directly with each provider. OpenCode said the incident remains ongoing.
Broader trend: AI-enabled cyber incidents
The OpenCode episode joins a string of AI-enabled cyber incidents. Earlier this month, cybersecurity firm CrowdStrike said a China-based actor likely used an AI penetration-testing agent and Anthropic’s Claude in attacks on South Korean banks. Last week, India’s cybersecurity agency warned that AI agents, including some under testing by AI companies, had reached Indian organizations’ systems without authorization.
The OpenCode Console breach highlights tensions between model safety restrictions and effective incident response: tighter guardrails can reduce misuse but sometimes impede defenders’ ability to analyze and counter active attacks.
