The open-source AI programming agent OpenCode has recently gained popularity among developers as an alternative to Claude Code and Cursor. The company stated on Saturday that attackers compromised its older system overnight, affecting 1.4% of users on the online platform OpenCode Console. Some users store API keys—digital passwords used to access AI services—on this platform.
As the OpenCode team worked to respond to the attack, this emergency incident highlighted an increasingly serious issue: companies using AI models that have not been reviewed and have fewer access restrictions struggle to defend against large-scale, AI-driven cyberattacks.
OpenCode wrote on X: "We experienced a security incident related to a large-scale distillation attack, affecting 1.4% of OpenCode Console users. We notified all affected users via email this morning." The company stated that users who did not receive an email were not impacted.
The company did not explain how the distillation attack occurred. However, the leaked API keys may have enabled users in countries with restricted access to the U.S. model to generate the large volume of outputs required for the process. Some skeptics believe this claim is exaggerated, suggesting the incident was merely a standard breach, and whether it was used for distillation remains unconfirmed.
On the night of the incident, developers began posting alerts about withdrawals and unauthorized charges on Reddit and X. One developer wrote: "I saw notifications for my OpenAI, Anthropic, and Google AI expenses go off before bed and had no idea what was happening."
Other users reported that individual accounts were charged hundreds of dollars; a few stated the total exceeded $1,000.
Anthropic and Google have both blocked API keys they believe were leaked, while OpenAI stated it has collaborated with OpenCode to restore access and has refunded credits to its API customers that were used during the attack. OpenCode said refunds for unauthorized charges are currently in progress.
The exposed keys were limited to the Console, which some users stored in their workspaces. Co-founder Dax Raad stated that open-source applications and command-line tools were unaffected. He wrote on X: “Note that this is OpenCode Console, not OpenCode itself—those keys never reached us.”
Even as users and AI companies work to deactivate these exposed keys, the OpenCode team faces mounting pressure. Raad said attackers have been continuously attempting to breach their system for 48 hours straight, forcing the team to run AI defense agents around the clock. The AI models used by the OpenCode team for analysis initially helped, but began refusing to operate once the malicious code they were asked to inspect triggered security filters.
He wrote on X: "This is a bit frustrating."
Subsequently, OpenCode gained access to OpenAI’s Daybreak Blue program, which provides reviewed users with AI models less likely to reject defensive security work requests. Raad said this access enhanced the team’s ability to investigate the attack.
OpenCode is not the first company to encounter this challenge. In July, the AI platform Hugging Face stated that commercial AI models prevented it from analyzing logs of an intrusion attempt initiated by autonomous AI agents; OpenAI later disclosed that these agents were actually their own models, with safety restrictions temporarily lowered during testing. Hugging Face titled its blog post “An Asymmetric Problem,” noting that the defense mechanisms “cannot distinguish between incident responders and attackers.”
Security researchers have also raised similar complaints, noting that these restrictions are inconsistent and have pushed some users toward foreign open-source weight models, which anyone can download and run.
The events this weekend also drew a response from David Sacks, Co-Chair of the U.S. President’s Council of Advisors on Science and Technology.
He wrote on X: "OpenCode (and earlier Hugging Face) hit the same wall midway through the attack: state-of-the-art models refused to analyze the exploits needed for defense because the payloads triggered security filters. The safeguards backfired."
The breach occurred on the same night OpenCode made GLM-5.3-Flash freely available to users. The broader GLM-5.3 series has drawn attention from researchers studying open-weight models, who noted that its cybersecurity capabilities have approached levels previously associated only with restricted-access models, such as Anthropic’s Claude Mythos Preview.
OpenCode has not yet provided detailed information on how the attackers gained access to the old system, how the keys were stored, or the full extent of the misuse. The company has requested that affected users directly revoke and rotate their keys with their respective service providers. The company stated that this incident is still ongoing.
This intrusion occurs amid a growing number of AI-powered cyber incidents. Earlier this month, cybersecurity firm CrowdStrike stated that a hacker suspected to be from China may have used AI-powered penetration testing agents and Claude in an attack targeting Korean banks. Last week, India’s cybersecurity agency warned that AI agents, including some tested by AI companies, have gained unauthorized access to systems of Indian organizations.