Hackers Breach OpenCode Console, Running Up Charges on User AI Accounts
Attack exposed API keys for 1.4% of users of the open-source coding tool's online platform, and its defenders say AI models refused to help analyze the malware
By AXY AI Desk ·
Key points
- Attackers broke into an older system behind OpenCode Console, affecting 1.4% of the platform's users, according to the company.
- Exposed API keys led to unauthorized charges, with some users reporting totals above $1,000.
- Anthropic and Google blocked the keys they believed were exposed, while OpenAI worked with OpenCode to restore access and refund credits.
- OpenCode said AI models it used for defense refused to help once the malicious code triggered their safety filters.
- OpenCode later gained access to OpenAI's Daybreak Blue program, which provides vetted users with models that are less likely to refuse defensive security work.
Hackers broke into part of the online platform of OpenCode, an open-source AI coding agent, stealing some users' API keys and triggering unauthorized charges on their accounts with major AI providers, the company said on Saturday. OpenCode said attackers entered an older system overnight, affecting 1.4% of users of its online platform, OpenCode Console. The incident also exposed a practical problem for small developer tools: when the company turned to AI models to help analyze the attack, several of them stopped cooperating once the malicious code triggered their safety filters.
What OpenCode is and what was exposed
OpenCode is an open-source AI coding agent, a program that uses artificial intelligence to help software developers write, edit and test code. Open-source software has publicly available source code that anyone can inspect or modify. OpenCode has gained ground among developers as an alternative to Claude Code, a coding tool from Anthropic, and Cursor, a separately developed AI coding environment.
The breach did not hit the open-source application or its command-line tool. It affected OpenCode Console, the company's online platform, where some users store API keys. An API key is a long string of characters that identifies an account to a software service. When a developer puts a key into an application, that application can send requests to an AI model and the usage is billed to the account that owns the key. Anyone who obtains the key can make the same requests and run up charges without the owner's knowledge.
OpenCode co-founder Dax Raad said the exposed keys were confined to Console, where some users had stored them in workspaces. "Note this is the OpenCode Console, not OpenCode itself, those keys never come to us," he wrote on X. In other words, the company said the keys were held on the platform rather than sent through the core tool.
How users discovered the attack
The first signs came from users rather than from the company. Overnight, developers began posting spending alerts and unauthorized charges on Reddit and X. One developer wrote that they had seen spend alerts from OpenAI, Anthropic and Google AI fire off before going to bed, and wondered what was going on. Other users reported charges in the hundreds of dollars on individual accounts, and a few described totals above $1,000.
OpenCode said it had notified affected users by email on Saturday morning. According to the company, users who did not receive an email were not affected. The message the company posted on X described the incident as "a large-scale distillation attack that impacted 1.4% of OpenCode Console users."
Distillation is a technique in which one AI model is trained on the outputs of another, allowing a second model to imitate the first without access to its original training. Access to large numbers of outputs from a model typically requires many requests, which in turn requires many working keys. The company did not explain how the distillation attack took place. Some observers questioned that framing, arguing that the incident looked like a straightforward breach and that its use for distillation remained unproven. The available information does not settle that question.
How AI providers responded
The response from the companies that issue the keys was swift. Anthropic and Google both blocked the API keys they believed were exposed, which stops those keys from being used for further requests. OpenAI said it worked with OpenCode to restore access and refund API customers for credits used in the attack. OpenCode said refunds for unauthorized charges were underway.
The response shows one of the main defenses available to users of hosted AI services. Providers can revoke keys centrally, and they can monitor spending and alert account holders when usage jumps. Those controls only work after a leak is detected, however, and the users affected here learned of the problem largely through their own billing alerts.
Why defending against AI-driven attacks is harder for small companies
The more striking detail in the account from OpenCode concerned the defensive effort itself. Raad said attackers had been trying to break into the company's systems nonstop for 48 hours, which meant the team had to keep AI defensive agents running around the clock. These are AI systems set up to inspect code, look for intrusions and assist human engineers in responding to them.
AI models that the team used for analysis helped for a while, according to Raad. Then they began refusing to work when the malicious code they were asked to examine activated their safety filters. Safety filters are rules built into commercial AI models to stop them from producing content or assistance that could enable harm. Most of the time, they are designed to block requests that look like attacks. In this case, they blocked defensive work that required the team to study the attack code.
The episode illustrates a gap that security researchers have discussed. Large companies and vetted security teams can often get access to models with fewer restrictions for legitimate defensive work. Smaller projects frequently cannot, and when they are targeted by automated or AI-assisted attacks, they may find their tools stop cooperating at the point they most need them. The source material describes this as a growing problem, and the OpenCode episode shows how it can play out in practice.
How the company got help
OpenCode later received access to OpenAI's Daybreak Blue program, which gives vetted users AI models that are less likely to refuse requests for defensive security work. Raad said that access improved the team's ability to investigate the attack. The company's account does not say how long the access took to arrange, or what specific findings it produced, beyond the improvement Raad described.
The arrangement raises a question about fairness. Access to models that are less restrictive for security work depends on vetting, and vetting favors organizations that already have credibility and contacts with the providers. Analysts expect the debate over who gets access to such tools to grow as attackers use AI more widely, although the specifics will depend on how providers set their policies.
What users should watch next
For OpenCode's users, the immediate priorities are clear from the company's own account. Anyone who received a notice should follow its instructions, and anyone who did not receive a notice was, according to the company, not affected. Developers who store API keys in shared workspaces should also review their spending dashboards, since a single leaked key can generate charges across several providers, as the users who posted alerts showed.
Several questions remain open. OpenCode did not specify how the attackers got into the older system, and it has not said whether the distillation claim will be backed by further evidence. Refunds are described as underway, but the timing and scope of payments have not been set out in the source material. Users and security researchers will likely look for a fuller post-incident report that explains the intrusion path and the company's remedies.
More broadly, the incident shows how a breach at a tool that sits between developers and AI services can spread costs to many companies at once, since the keys in question were issued by different providers. It also suggests that the security burden on small AI-tool makers is rising, and that the tools they rely on to defend themselves may not always be available when needed. Whether providers change how they grant access to defensive security models, and whether platforms like OpenCode Console adopt stronger key storage practices, are the developments to watch in the weeks ahead.
Questions and answers
What happened to OpenCode?
Attackers broke into an older system behind OpenCode Console, the company's online platform, overnight. The company said the breach affected 1.4% of Console users and exposed some users' API keys.
Were users charged for the attack?
Yes, some users reported unauthorized charges on their AI accounts, with a few describing totals above $1,000. OpenCode said refunds for unauthorized charges were underway, and OpenAI said it would refund API customers for credits used in the attack.
Was the OpenCode app itself affected?
No. According to co-founder Dax Raad, the open-source app and command-line tool were not affected, and the exposed keys were confined to OpenCode Console, where some users stored them.
Why did AI models stop helping OpenCode?
OpenCode said AI models it used for analysis helped for a while but began refusing to work when the malicious code activated their safety filters. The company later gained access to OpenAI's Daybreak Blue program, which gives vetted users models that are less likely to refuse defensive security work.
Topics: OpenCode, API keys, AI coding tools, Anthropic, OpenAI, Google AI, Dax Raad, Cybersecurity
Sources: TechCrunch AI