If you stored an API key in a hosted dashboard, assume it’s a target. That’s the plain lesson from OpenCode, where attackers broke into an older system overnight and ran up charges on other people’s AI accounts. The bigger irony is that the team’s AI analysis tools balked at the malicious code they needed to study.
OpenCode is an open source coding agent that developers use as an alternative to Claude Code and Cursor. According to TechCrunch, the company said Saturday that the breach hit 1.4% of users of OpenCode Console, its online platform, where some people keep the API keys they use to reach AI services. The open source app and command-line tool were not affected. Co-founder Dax Raad said those keys never come to OpenCode.
The company calls it a “large-scale distillation attack.” It hasn’t explained that label. Leaked keys can give users in countries with restricted access to American models a way to generate the huge volume of outputs distillation needs. But some skeptics say the framing stretches the facts, and that this was a straightforward breach with distillation unproven. I’d side with caution. A vague label is convenient when you haven’t yet explained how attackers got in.
Users felt the damage first. Developers posted spend alerts from OpenAI, Anthropic and Google firing overnight. Some saw hundreds of dollars in charges, a few more than $1,000. Anthropic and Google blocked the keys they believed were exposed. OpenAI worked with OpenCode to restore access and refund affected customers, and OpenCode says its own refunds are underway.
What OpenCode hasn’t said matters more for privacy. It hasn’t detailed how attackers reached the older system, how keys were stored, or how far the misuse went. It told affected users to revoke and replace keys directly with each provider, and said the incident is ongoing. If you got no email, you weren’t affected, the company says. That’s a claim you can’t check yourself.
The response exposed a second problem. Raad said attackers hammered the systems for 48 hours, and the team ran AI defensive agents around the clock. The models helped, then started refusing once the malicious code tripped safety filters. OpenCode later got into OpenAI’s Daybreak Blue program, which gives vetted users models less likely to refuse defensive security work. Raad said it improved the investigation.
This isn’t new. In July, Hugging Face said commercial models blocked its attempts to analyze logs from an intrusion by autonomous AI agents, which OpenAI later said were its own models running with lowered safeguards in a test. Hugging Face wrote that guardrails “cannot distinguish an incident responder from an attacker.” Security researchers complain the restrictions are inconsistent, and some have moved to foreign open-weight models anyone can download.
David Sacks seized on the episode, saying the guardrails “backfired.” That’s a political read, and it skips an uncomfortable point: vetted-access programs mean small teams without connections defend themselves with weaker tools. Meanwhile, attacks keep coming. CrowdStrike linked a China-based hacker to AI-assisted attacks on South Korean banks, and India’s cybersecurity agency warned of AI agents reaching systems without authorization.
For users, the advice is dull but real. Keep keys out of hosted workspaces where you can, set spending caps, and turn on alerts. Those alerts caught this one.