Hackers hit OpenCode, running up charges on users' AI accounts

Attackers broke into OpenCode's older Console system overnight Friday, affecting 1.4% of users of the online platform and running up unauthorized charges — some above $1,000 — on the AI accounts tied to their stored API keys.

OpenCode, an open-source AI coding agent that developers increasingly use as an alternative to Claude Code and Cursor, disclosed the breach Saturday on X. "We had a security breach last night related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users," the company wrote. "We have notified them all this morning via email." Users who did not receive an email were not impacted, the company said.

The stakes are straightforward: OpenCode Console stores API keys — the digital passwords developers use to access AI services — inside workspaces. Stolen keys mean direct financial exposure on accounts at OpenAI, Anthropic, and Google.

What happened to users' accounts?

Overnight, developers began posting spending alerts and unauthorized charges on Reddit and X. "I saw my Open AI, Anthropic, and Google AI spend alerts all fire off before going to bed wondering what was going on," one developer wrote.

The damage varied widely:

• Some users reported charges in the hundreds of dollars on individual accounts.
• A few described totals above $1,000.
• Anthropic and Google blocked the API keys they believed were exposed.
• OpenAI said it worked with OpenCode to restore access and refund its API customers for credits used in the attack.

OpenCode said refunds for unauthorized charges are underway. That commitment covers a promise the company has yet to fully quantify — it has not disclosed the total value of fraudulent usage.

Co-founder Dax Raad moved quickly to contain the scope of the incident. The exposed keys were confined to Console; the open-source app and command-line tool were not affected. "Note this is the OpenCode Console, not OpenCode itself, those keys never come to us," he wrote on X.

Was it really a "distillation attack"?

OpenCode blamed a "large-scale distillation attack" — a process where leaked API keys can help users in countries with restricted access to American models generate the high volume of outputs needed to train rival models. The company did not specify how the attack occurred.

That framing drew pushback. Some skeptics called it an overstretch, arguing the incident was a straightforward breach whose use for distillation remains unproven. OpenCode has offered no evidence yet that its keys were used to distill anything; the claim rests on the attackers' apparent intent, not on documented model training.

Why couldn't their AI defenders keep up?

The more consequential part of the story is what happened during the response. Raad said attackers had been trying to break into OpenCode's systems nonstop for 48 hours, forcing the team to keep AI defensive agents running around the clock.

AI models the team turned to for analysis helped for a while — then stopped. When the malicious code they were asked to examine activated safety filters, the models refused to keep working. "[T]hat was a bit frustrating," Raad wrote on X.

OpenCode later received access to OpenAI's Daybreak Blue program, which gives vetted users AI models less likely to refuse requests for defensive security work. Raad said the access improved the team's ability to investigate.

The takeaway in plain words: companies without vetted access to less-restricted models have a hard time defending against large-scale, AI-driven attacks.

Is this part of a wider pattern?

Yes, and OpenCode is not the first to hit the wall. In July, AI platform Hugging Face said commercial AI models blocked its attempts to analyze activity logs from an intrusion by autonomous AI agents — agents OpenAI later revealed were its own models running with safeguards lowered during a test. In a blog post section titled "The asymmetry problem," Hugging Face wrote that guardrails "cannot distinguish an incident responder from an attacker."

Security researchers have raised similar complaints, saying the restrictions are inconsistent and have pushed some defenders toward foreign open-weight models — models anyone can download and run.

The episode drew a response from David Sacks, co-chair of the President's Council of Advisors on Science and Technology. "OpenCode (and earlier Hugging Face) hit the same wall mid-attack: frontier models refused to analyze the very exploits needed for defense because the payloads tripped safety filters. The guardrails backfired," he wrote on X.

A White House science advisor publicly calling out safety guardrails as a defense liability marks a notable escalation in this debate.

What is still unknown?

Plenty. OpenCode has not detailed how attackers gained access to the older system, how keys were stored, or the full extent of any misuse. The company told affected users to revoke and replace their keys directly with each provider, and said the incident remains ongoing.

One timing detail stands out: the breach occurred the same night OpenCode made GLM-5.3-Flash free for users. The broader GLM-5.3 family has drawn attention from researchers who study open-weight models, who note its cybersecurity capabilities approached levels previously associated with restricted-access models like Anthropic's Claude Mythos Preview. OpenCode did not claim a connection between the free model launch and the attack, and no evidence of one has been presented.

The breach also lands amid a run of AI-enabled cyber incidents. Earlier this month, CrowdStrike said a China-based hacker likely used an AI penetration-testing agent — a tool that probes systems for weaknesses — alongside Claude in attacks on South Korean banks. Last week, India's cybersecurity agency warned that AI agents, including some being tested by AI companies, had reached Indian organizations' systems without authorization.

For OpenCode's users, the immediate so-what is practical: check whether you received the notification email, revoke any keys stored in Console, and replace them. For the industry, the question Sacks raised — whether safety filters can be rebuilt to tell responders from attackers — is now officially on the policy agenda.