OpenCode, a tool that developers use to write code with AI, says attackers broke into one of its older systems and exposed AI provider API keys that some users had stored there. Developers reported unauthorised charges on their AI accounts, some in the hundreds of dollars and a few above $1,000, TechCrunch reports.
The company calls the incident ongoing. Here is what it has said, what it advises and what remains unclear.
What happened
According to TechCrunch, the attackers got into an older OpenCode system overnight. OpenCode announced the breach on Saturday and said it affected 1.4% of users of OpenCode Console. It called the incident a “large-scale distillation attack” as well as a security breach. Some sceptics argue it was an ordinary intrusion and that the distillation claim is unproven. OpenCode has not said how the attackers got in.
Console users sometimes stored API keys from AI providers in their workspaces, and those keys were exposed. The open-source app and the command-line tool were not affected, according to co-founder Dax Raad, who said the keys never reached OpenCode’s own systems. Developers reported spending alerts and unauthorised charges overnight.
What OpenCode told users
OpenCode emailed affected users on the morning of the breach. It said that anyone who did not receive an email was not affected. It told users to revoke and replace their keys directly with each AI provider, and said refunds for unauthorised charges were under way.
Our suggestion, not OpenCode’s: if you stored provider keys in a hosted tool, check each provider’s usage and spending dashboard for charges you do not recognise.
How the AI providers responded
Anthropic and Google blocked API keys they believed had been exposed. OpenAI worked with OpenCode to restore access and refund API customers for the credits used in the attack, TechCrunch reports.
The defenders hit a wall
OpenCode’s account of the response raises a separate issue. Raad said attackers had been trying to break in nonstop for 48 hours, so the team kept AI defensive agents running around the clock. The AI models they used to analyse the attack helped at first, then refused to continue once the malicious code they were examining triggered the models’ safety filters.
OpenCode later gained access to OpenAI’s Daybreak Blue programme, which gives vetted users models that are less likely to refuse defensive security work. Raad said that improved the investigation.
That issue has come up before. TechCrunch notes that Hugging Face reported in July that commercial models refused to analyse logs from an intrusion by autonomous AI agents. David Sacks, who co-chairs the President’s Council of Advisors on Science and Technology, said on X that guardrails “backfired” in both cases.
Other context
The breach happened the same night OpenCode made the model GLM-5.3-Flash free to users. TechCrunch also notes that CrowdStrike reported earlier this month that a China-based hacker likely used an AI penetration-testing agent and Claude in attacks on South Korean banks, and that India’s cybersecurity agency warned last week that AI agents had reached Indian organisations’ systems without authorisation.
What we do not know
OpenCode has not said how the attackers got in, how the keys were stored, how many people were affected beyond the 1.4% share, or how much was charged in total. Whether the attack was a “distillation attack”, as OpenCode says, is disputed. We have not read OpenCode’s own posts, which TechCrunch links, and the company says the incident is still going on.
We will update this article as OpenCode and the providers say more.
Leave a Reply