OpenCode hack: attackers expose users' AI API keys and run up charges on their accounts

OpenCode, an open-source AI coding agent that is gaining ground among developers as an alternative to Claude Code and Cursor, said on Saturday that attackers broke into a legacy system overnight. The incident affected 1.4% of users of OpenCode Console, its online platform. Some users store the API keys (digital passwords) they use to access AI services there.

On X, the company described "a security breach related to a large-scale distillation attack." It said it had emailed everyone affected, and that anyone who did not get the message was not impacted. It did not explain how the distillation attack worked. According to the article, leaked keys can help users in countries with restricted access to US models generate the large volume of outputs that distillation requires. Some skeptics think that framing is exaggerated. They argue it was a conventional breach and that the keys' use for distillation has not been proven.

Overnight, several developers posted spending alerts and reports of unauthorized charges on Reddit and X. One wrote that they saw spending alerts from OpenAI, Anthropic and Google go off at the same time. Other users reported charges of hundreds of dollars on individual accounts, and a few reported totals above $1,000.

Anthropic and Google blocked the keys they believed had been exposed. OpenAI said it worked with OpenCode to restore access and refund its API customers for credits used in the attack. OpenCode says refunds for the unauthorized charges are under way.

The exposed keys were limited to Console, where some users kept them in workspaces. According to co-founder Dax Raad, the open-source app and the command-line tool were not affected. Raad wrote: "This is OpenCode Console, not OpenCode itself; those keys never reach us."

The team was still under pressure. Raad said attackers had been trying to get into their systems nonstop for 48 hours, which forced them to keep defensive AI agents running around the clock. The AI models they used for analysis helped for a while. But they began refusing to work when the malicious code they were supposed to examine triggered their safety filters. Raad called this "a bit frustrating." OpenCode then got access to OpenAI's Daybreak Blue program, which gives verified users models that are less likely to refuse defensive security requests. According to Raad, that improved the team's ability to investigate the attack.

The article notes that this is not the first such case. In July, Hugging Face said commercial AI models blocked its attempts to analyze the activity logs from an intrusion by autonomous AI agents. OpenAI later revealed that these were its own models, running with reduced safeguards during a test. In a section of its blog titled "The asymmetry problem," Hugging Face wrote that guardrails "cannot distinguish an incident responder from an attacker." Security researchers have voiced similar complaints. They say the restrictions are inconsistent and have pushed some toward foreign open-weight models, which anyone can download and run.

David Sacks, co-chair of the President's Council of Advisors on Science and Technology, responded on X that OpenCode, and Hugging Face before it, hit the same wall in the middle of an attack: frontier models refused to analyze the exploits they needed to defend themselves because the payloads triggered safety filters. He concluded that "the guardrails backfired."

The breach happened on the same night OpenCode made GLM-5.3-Flash free for its users. According to the article, the GLM-5.3 family has caught the attention of open-weight model researchers, who say its cybersecurity capabilities come close to those of restricted-access models such as Anthropic's Claude Mythos Preview.

OpenCode has not said how the attackers got into the legacy system, how the keys were stored or how far the misuse went. It has asked those affected to revoke and replace their keys directly with each provider. The company says the incident is still ongoing.

The case adds to a string of AI-related cyber incidents. Earlier this month, CrowdStrike said a China-based hacker probably used an AI penetration-testing agent, which looks for weaknesses in computer systems, together with Claude in attacks on South Korean banks. Last week, India's cybersecurity agency warned that AI agents had reached the systems of Indian organizations without authorization, including some agents used to test companies in the sector.