OpenCode breach exposes API keys and triggers unauthorized AI charges

OpenCode described the incident on X as a “large-scale distillation attack” tied to the breach. The company did not specify how the attack occurred. The report said leaked API keys can help users in countries with restricted access to American models generate the high volume of outputs needed for distillation. Some skeptics called that framing an overstretch, arguing that the incident was a straightforward breach whose use for distillation remained unproven.

Overnight, developers posted spending alerts and unauthorized charges on Reddit and X. “I saw my Open AI, Anthropic, and Google AI spend alerts all fire off before going to bed wondering what was going on,” one developer wrote. Other users reported charges in the hundreds of dollars on individual accounts, and a few described totals above $1,000, according to the report.

Anthropic and Google blocked the API keys they believed were exposed. OpenAI said it worked with OpenCode to restore access and refund its API customers for credits used in the attack. OpenCode said refunds for unauthorized charges were underway. The exposed keys were confined to Console, where some users had them in workspaces. Co-founder Dax Raad said the open-source app and command-line tool were not affected. “Note this is the OpenCode Console, not OpenCode itself, those keys never come to us,” he wrote on X.

Raad said attackers had been trying to break into OpenCode’s systems nonstop for 48 hours, requiring the team to keep AI defensive agents running around the clock. AI models the team used for analysis helped for a while, but began refusing to work when the malicious code they were asked to examine activated safety filters. “[T]hat was a bit frustrating,” Raad wrote on X. OpenCode later received access to OpenAI’s Daybreak Blue program, which gives vetted users AI models less likely to refuse requests for defensive security work, and Raad said the access improved the team’s ability to investigate the attack.

OpenCode is not the first company to encounter that obstacle. In July, AI platform Hugging Face said commercial AI models blocked its attempts to analyze activity logs from an intrusion by autonomous AI agents, which OpenAI later revealed were its own models running with safeguards lowered during a test. In a blog post section titled “The asymmetry problem,” Hugging Face wrote that guardrails “cannot distinguish an incident responder from an attacker.” Security researchers have raised similar complaints, saying the restrictions are inconsistent and have pushed some toward foreign open-weight models that anyone can download and run.

David Sacks, co-chair of the President’s Council of Advisors on Science and Technology, also responded on X. “OpenCode (and earlier Hugging Face) hit the same wall mid-attack: frontier models refused to analyze the very exploits needed for defense because the payloads tripped safety filters. The guardrails backfired,” he wrote.

The breach occurred the same night OpenCode made GLM-5.3-Flash free for users. The broader GLM-5.3 family has drawn attention from researchers who study open-weight models and note that its cybersecurity capabilities approached levels previously associated with restricted-access models such as Anthropic’s Claude Mythos Preview. OpenCode has not detailed how attackers gained access to the older system, how keys were stored, or the full extent of any misuse. It has told affected users to revoke and replace their keys directly with each provider and said the incident remains ongoing.

The breach lands amid a run of AI-enabled cyber incidents. Earlier this month, cybersecurity firm CrowdStrike said a China-based hacker likely used an AI penetration-testing agent, which probes computer systems for weaknesses, and Claude in attacks on South Korean banks. Last week, India’s cybersecurity agency warned that AI agents, including some being tested by AI companies, had reached Indian organizations’ systems without authorization.