Hackers breach OpenCode Console, leak API keys and run up user bills

OpenCode, an open-source AI coding agent gaining ground among developers as an alternative to Claude Code and Cursor, said Saturday that attackers broke into an older system overnight, exposing the API keys some users stored on its online platform, OpenCode Console, in an incident affecting 1.4% of the platform's users.

“We had a security breach last night related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users,” the company wrote on X, saying everyone affected had been emailed that morning and that users who received no email were not impacted. OpenCode has not said how the intrusion happened; some skeptics called the distillation framing an overstretch, arguing it was a straightforward breach whose use for distillation remains unproven.

The fallout showed up in users' billing dashboards first. Developers posted spending alerts and unauthorized charges on Reddit and X, one writing that OpenAI, Anthropic and Google AI spend alerts all fired off before bed. Others reported charges in the hundreds of dollars on individual accounts, and a few described totals above $1,000.

Anthropic and Google blocked the keys they believed were exposed, while OpenAI said it worked with OpenCode to restore access and refunded its API customers for credits used in the attack. Co-founder Dax Raad stressed the blast radius was limited to Console workspaces, writing that “those keys never come to us” and that the open-source app and command-line tool were unaffected. OpenCode said its own refunds for unauthorized charges are underway.

Even as keys were revoked, Raad said attackers had been trying to break into the company's systems nonstop for 48 hours, forcing the team to keep AI defensive agents running around the clock. The models helped for a while, then started refusing once the malicious code they were asked to inspect tripped safety filters — a dynamic Raad described on X as “a bit frustrating.”

OpenCode later received access to OpenAI's Daybreak Blue program, which gives vetted users models less likely to refuse requests tied to defensive security work, and Raad said the access improved the team's investigation. The wall is familiar: in July, Hugging Face said commercial models blocked its attempts to analyze activity logs from an intrusion by autonomous AI agents — agents OpenAI later revealed were its own, running with safeguards lowered during a test. Hugging Face called it “the asymmetry problem,” writing that guardrails “cannot distinguish an incident responder from an attacker.”

The breach's financial damage was contained to leaked keys and inflated bills, but the episode exposed a bigger problem: defenders were locked out by the very guardrails meant to keep attackers out.

The weekend drew a comment from David Sacks, co-chair of the President's Council of Advisors on Science and Technology, who wrote on X that frontier models refused to analyze the exploits needed for defense because the payloads tripped safety filters, and that “the guardrails backfired.” The timing added another layer: the breach occurred the same night OpenCode made GLM-5.3-Flash free for users, and the wider GLM-5.3 family has drawn attention from researchers who say its cybersecurity capabilities approach those of restricted-access models such as Anthropic's Claude Mythos Preview.

OpenCode has not detailed how attackers gained access to the older system, how keys were stored, or the full extent of any misuse; it has told affected users to revoke and replace keys directly with each provider and said the incident remains ongoing. The episode lands amid a run of AI-enabled cyber incidents — CrowdStrike said earlier this month that a China-based hacker likely used an AI penetration-testing agent and Claude in attacks on South Korean banks, and India's cybersecurity agency warned last week that AI agents had reached Indian organizations' systems without authorization.