Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts

OpenCode, the open source coding agent that has been winning developers away from Claude Code and Cursor, says attackers got into an older system and exposed API keys belonging to 1.4% of users of OpenCode Console, its online platform. Those keys unlock paid accounts at OpenAI, Anthropic and Google. Developers reported spend alerts firing overnight, with charges in the hundreds of dollars on individual accounts and a few above $1,000.

The company calls it a large-scale distillation attack, meaning the stolen access was likely used to pump out model outputs at volume. Some skeptics say that framing is unproven and this was a plain breach. Either way, the keys were real money, and they were sitting in a hosted workspace.

The second story is the one with policy weight. While the team fought off what its co-founder described as 48 hours of nonstop intrusion attempts, the commercial models it leaned on for analysis started refusing once the malicious code tripped safety filters. Help only improved after OpenAI admitted the team to its Daybreak Blue program for vetted defenders.

Start with the basics, because they matter most to the people who got billed. Storing third-party API keys in a cloud console concentrates risk. One older, under-watched system became a single door to paid accounts across three providers. OpenCode deserves credit for notifying affected users quickly and pushing refunds, and the providers moved fast: Anthropic and Google blocked exposed keys, OpenAI worked on restoration and refunds. But the company still hasn't said how attackers got in, how the keys were stored, or how far the misuse went, and it says the incident is ongoing. Until that's public, we'd treat any hosted place that holds model keys as a target.

Now the harder problem. We've said before that safety filters are worth having, and we still think so. But a guardrail that can't tell an incident responder from an attacker is a guardrail that fails the defender at the worst possible moment. Hugging Face hit the same wall in July and named it the asymmetry problem. OpenCode just hit it again. The attackers kept coming for two straight days. The defenders were the ones getting refusals.

The fix that worked here was access-based: get vetted, get a less restrictive model. That's a reasonable answer for a known, funded project with a line to OpenAI. It's a poor answer for the small team or solo maintainer who gets hit at 2 a.m. with no relationship to any lab. If defensive access depends on who you know, security becomes another advantage for the already connected.

There's also a quiet market consequence. Security researchers say inconsistent refusals are pushing some of them toward foreign open-weight models anyone can download. That's the opposite of what the restrictions were meant to achieve. Meanwhile the same night OpenCode made GLM-5.3-Flash free, from a model family that researchers say approaches the cyber capability of restricted-access systems. Capability is spreading regardless of who holds the gate.

Where this leads if it scales: more AI-driven attacks running at machine speed, met by human teams whose own tools balk. That is not a stable arrangement. We'd like to see labs publish clear, fast verification paths for incident response, and tooling companies stop holding raw provider keys when they don't have to. Credit to OpenCode for being open about the refusals. That candor is how this gets fixed.

OpenCode's co-founder Dax Raad stressed that the open source app and command-line tool were not affected; only keys users chose to store in Console workspaces were exposed. David Sacks, co-chair of the President's Council of Advisors on Science and Technology, publicly cited the OpenCode and Hugging Face episodes as evidence that model guardrails backfired. The breach follows other recent AI-linked incidents, including CrowdStrike's report that a China-based hacker likely used an AI penetration-testing agent and Claude against South Korean banks, and a warning from India's cybersecurity agency about AI agents reaching organizations' systems without authorization.