OpenCode, an open-source AI coding agent competing with Claude Code and Cursor, reported Saturday that attackers breached an older system overnight. This incident affected 1.4% of users on its OpenCode Console platform, where some users store the API keys required to access various AI services.
As the OpenCode team worked to contain the attack, the scramble to respond highlighted a critical vulnerability: companies utilizing AI models with fewer safety restrictions struggle to defend against large-scale, AI-driven cyberattacks.
“We had a security breach last night related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users,” the company stated on X. “We have notified them all this morning via email.” The company clarified that users who did not receive an email were not impacted.
While the company did not specify the technical details of the distillation attack, it is known that leaked API keys enable users in countries with restricted access to American models to generate high volumes of data. Some skeptics argued that the company’s framing was an overstatement, claiming the incident was a standard breach with unproven use for distillation.
Overnight, developers took to Reddit and X to report spending alerts and unauthorized charges. One developer wrote, “I saw my Open AI, Anthropic, and Google AI spend alerts all fire off before going to bed wondering what was going on.”
Other users reported charges in the hundreds of dollars, with a few totals exceeding $1,000. In response, Anthropic and Google blocked the exposed API keys, while OpenAI collaborated with OpenCode to restore access and refund customers for credits used during the attack. OpenCode confirmed that refunds for unauthorized charges are currently underway.
The exposed keys were confined to the Console workspace and did not affect the open-source app or command-line tool, according to co-founder Dax Raad. He noted on X, “Note this is the OpenCode Console, not OpenCode itself, those keys never come to us.”
Despite efforts to disable the exposed keys, the OpenCode team faced immense pressure. Raad revealed that attackers had attempted to break into the systems nonstop for 48 hours, forcing the team to keep AI defensive agents running continuously. While the team initially used AI models for analysis, they ultimately had to abandon this approach when the safety filters on the malicious code caused the models to refuse cooperation.
“[T]hat was a bit frustrating,” he wrote on X.
Later, OpenCode gained access to OpenAI’s Daybreak Blue program, which provides vetted users with AI models less likely to refuse requests for defensive security work. Raad stated that this access significantly improved the team's ability to investigate the attack.
OpenCode is not the first organization to encounter this obstacle. In July, Hugging Face reported that commercial AI models blocked its attempts to analyze intrusion logs, a problem later attributed to its own models running with lowered safeguards. Hugging Face wrote in a blog post titled “The asymmetry problem” that guardrails cannot distinguish between an incident responder and an attacker.
Security researchers have echoed these concerns, noting that inconsistent restrictions have pushed some towards foreign open-weight models that can be freely downloaded and executed.
David Sacks, co-chair of the President’s Council of Advisors on Science and Technology, commented on the weekend episode, writing that OpenCode and Hugging Face hit the same wall when frontier models refused to analyze necessary exploits because safety filters were triggered.
The breach occurred the same night OpenCode made its GLM-5.3-Flash model free for users. Researchers have noted that the GLM-5.3 family possesses cybersecurity capabilities approaching levels previously associated with restricted-access models like Anthropic’s Claude Mythos Preview.
OpenCode has not detailed how attackers gained entry to the older system, how keys were stored, or the full extent of the misuse. The company has advised affected users to revoke and replace their keys directly with their respective providers and has stated that the incident remains ongoing.
This breach comes amid a rising trend of AI-enabled cyber incidents. Earlier this month, CrowdStrike reported that a China-based hacker likely used an AI penetration-testing agent and Claude in attacks on South Korean banks. Last week, India’s cybersecurity agency warned that AI agents, including those currently being tested by AI companies, had infiltrated Indian organizations without authorization.
The Editorial Staff at AIChief is a team of professional content writers with extensive experience in AI and marketing. Founded in 2025, AIChief has quickly grown into the largest free AI resource hub in the industry.