OpenCode breach exposes API keys, triggers AI-driven charges

TechCrunch reports that OpenCode, an open-source AI coding agent, suffered a security breach affecting 1.4% of its online platform users. The incident, described by the company as a "large-scale distillation attack," occurred overnight and resulted in unauthorized charges on the AI service accounts of affected users. Developers reported seeing spending alerts from OpenAI, Anthropic, and Google fire off simultaneously, with some users describing unauthorized charges in the hundreds or even thousands of dollars.

The breach was confined to the OpenCode Console, a web-based interface where users store API keys for AI services. The open-source application and command-line tool were not affected, according to co-founder Dax Raad. "Note this is the OpenCode Console, not OpenCode itself, those keys never come to us," Raad wrote on X. The company has notified all impacted users via email and stated that refunds for unauthorized charges are underway.

The details of the attack

OpenCode stated that the breach was related to a "large-scale distillation attack," a process where high volumes of outputs are generated to train or fine-tune models. While the company did not specify exactly how the attack occurred, leaked API keys likely enabled attackers to generate these outputs. Some skeptics argued that the framing was an overstretch, suggesting it was a straightforward breach whose use for distillation remains unproven.

The response to the attack highlighted a significant operational challenge: the OpenCode team struggled to use AI tools for defense because safety filters in commercial models refused to analyze the malicious code involved in the attack. Raad noted that AI models used for analysis "started refusing to work when the malicious code they were asked to examine activated safety filters." This forced the team to keep AI defensive agents running around the clock for 48 hours while attackers continued to probe their systems.

To overcome this, OpenCode received access to OpenAI’s Daybreak Blue program, which provides vetted users with AI models less likely to refuse requests for defensive security work. Raad said this access improved the team’s ability to investigate the attack. Anthropic and Google also responded by blocking the API keys they believed were exposed, while OpenAI worked with OpenCode to restore access and refund API customers for credits used in the attack.

Context: The asymmetry problem

This incident is not isolated. In July, Hugging Face reported that commercial AI models blocked its attempts to analyze activity logs from an intrusion by autonomous AI agents. Hugging Face described this as "The asymmetry problem," noting that guardrails "cannot distinguish an incident responder from an attacker." Security researchers have raised similar complaints, stating that restrictions are inconsistent and have pushed some toward foreign open-weight models, which anyone can download and run without such filters.

David Sacks, co-chair of the President’s Council of Advisors on Science and Technology, commented on the episode, writing, "OpenCode (and earlier Hugging Face) hit the same wall mid-attack: frontier models refused to analyze the very exploits needed for defense because the payloads tripped safety filters. The guardrails backfired." The breach occurred the same night OpenCode made GLM-5.3-Flash free for users, a model family that has drawn attention for its cybersecurity capabilities.

What it means for developers

For developers using AI coding tools, this incident underscores the risks of storing API keys in third-party web interfaces. Users should avoid keeping sensitive keys in platforms that may not have the same security posture as the underlying AI providers. If you use OpenCode Console or similar services, you should immediately revoke and replace any API keys stored there, directly with each provider (OpenAI, Anthropic, Google, etc.).

The incident also highlights a growing tension in the AI security ecosystem: the same safety measures designed to prevent AI models from being misused for malicious purposes can hinder legitimate defensive work. Developers and security teams may need to seek access to specialized programs or use open-weight models for certain types of security analysis, though this comes with its own risks and compliance considerations.

What to watch

• Refund process: OpenCode said refunds for unauthorized charges are underway, but the full extent of the misuse is not yet detailed. Monitor your AI service statements for any further unauthorized activity.
• OpenCode’s security updates: The company has not detailed how attackers gained access to the older system or how keys were stored. Watch for updates on their security infrastructure and whether they will implement additional safeguards for the Console.
• AI safety filter policies: The incident may prompt AI providers to refine their safety filters to better distinguish between defensive and offensive use cases. Watch for announcements from OpenAI, Anthropic, and Google regarding changes to their API access policies or defensive security tools.
• Broader AI-enabled cyber incidents: This breach lands amid a run of AI-enabled cyber incidents, including a CrowdStrike report on a China-based hacker using an AI penetration-testing agent in attacks on South Korean banks. The trend suggests that AI-driven attacks are becoming more sophisticated and frequent.