Hackers breach OpenCode platform, exposing API keys and running up charges on users' AI accounts
An attack on the AI coding tool OpenCode affected 1.4% of users, leading to unauthorized charges on OpenAI, Anthropic, and Google AI accounts while exposing limitations in AI model safety filters during incident response.
What happened
OpenCode reported a security breach Saturday affecting 1.4% of its Console platform users who stored API keys for accessing AI services. Attackers gained access to an older system overnight, and developers quickly reported spending alerts and unauthorized charges—some in the hundreds or thousands of dollars—across OpenAI, Anthropic, and Google AI accounts. All three AI companies responded by blocking exposed keys; OpenAI refunded affected API customers while OpenCode said refunds for unauthorized charges were underway. The company described the incident as a "large-scale distillation attack," though some observers disputed whether the distillation use was confirmed or the incident was simply a straightforward breach. OpenCode co-founder Dax Raad noted that the exposed keys were confined to the Console platform and that the open-source app and command-line tool were not affected.
Context
The breach exposed a critical vulnerability in AI-powered security defense: when OpenCode's team attempted to use AI models to analyze malicious code during the attack, the models' safety filters activated and refused to process the payloads, hampering the investigation. Only after OpenCode gained access to OpenAI's Daybreak Blue program—which provides vetted users AI models with lowered safety guardrails for defensive security work—could the team effectively analyze the attack. This mirrors a July incident at Hugging Face, where commercial AI models similarly blocked security analysis, prompting David Sacks, co-chair of the President's Council of Advisors on Science and Technology, to describe an "asymmetry problem" in which guardrails cannot distinguish incident responders from attackers. The incident underscores a broader challenge: companies without vetted access to less-restricted AI models struggle to defend against large-scale AI-driven cyberattacks. The breach also arrives amid a documented rise in AI-enabled cyber incidents, including recent attacks on South Korean banks and unauthorized AI agent access to Indian organizations.
What's disputed
The framing of the attack as a "distillation attack" has been questioned by some observers, who argue the incident was a straightforward breach and that any use of leaked keys for distillation remains unproven. OpenCode has not detailed how attackers gained initial access to the older system or the full extent of any misuse.