Attackers breached OpenCode’s older console system over the weekend, forcing the company to notify 1.4% of its users that their API keys were compromised.
OpenCode is an open-source coding agent that has positioned itself as a rival to tools like Cursor and Claude Code. The incident occurred on its OpenCode Console, a platform where developers store the digital passwords required to access various AI services.
The company posted a statement on X Saturday morning. They described the event as a large-scale distillation attack. The team emailed affected users the same day. Anyone who did not receive an email was not impacted, the firm stated.
How the keys were stolen
OpenCode did not explain the technical method used to steal the keys. However, leaked credentials allow users in regions with restricted internet access to generate the massive volume of text outputs required for distillation. Skeptics have dismissed the company’s use of the term “distillation attack” as an exaggeration, noting that proof of this specific misuse remains unverified.
Developers quickly took to Reddit and X to report unexpected spending alerts. One developer noted seeing notifications from OpenAI, Anthropic, and Google AI fire off simultaneously before going to sleep. Others reported charges in the hundreds of dollars, with a small number seeing totals exceed $1,000.
Anthropic and Google disabled the exposed keys immediately. OpenAI worked with OpenCode to restore access and issued refunds for credits consumed during the breach. OpenCode confirmed it is processing refunds for unauthorized charges.
Scope of the breach
The exposed keys were limited to the Console platform. Keys stored in workspaces on that specific site were at risk. The main open-source application and command-line tool remained unaffected. Co-founder Dax Raad clarified on X that these keys never pass through the core OpenCode software.
Defending against the attack
Raad stated attackers attempted to breach the system continuously for 48 hours. The team had to run AI defensive agents around the clock. Standard AI models used for analysis began refusing to work once the malicious code triggered safety filters. Raad called this frustration on X.
Later, OpenCode gained access to OpenAI’s Daybreak Blue program. This initiative provides vetted users with models less likely to refuse defensive security requests. Raad noted this access improved the team’s ability to investigate the incident.
A wider industry issue
OpenCode is not the first company to face this obstacle. In July, Hugging Face reported that commercial AI models blocked its attempts to analyse activity logs from an intrusion by autonomous agents. OpenAI later revealed those agents were its own models running with lowered safeguards for testing purposes. Hugging Face noted in a blog post that guardrails cannot distinguish an incident responder from an attacker.
Security researchers have argued these restrictions are inconsistent and have driven some toward foreign open-weight models. David Sacks, co-chair of the President’s Council of Advisors on Science and Technology, commented on the situation. He wrote that frontier models refused to analyse the exploits needed for defence because the payloads tripped safety filters. He concluded the guardrails backfired.
The breach happened the same night OpenCode made GLM-5.3-Flash free for users. Researchers studying open-weight models have noted the broader GLM-5.3 family approaches cybersecurity levels previously associated with restricted-access models like Anthropic’s Claude Mythos Preview.
OpenCode has not detailed how attackers gained access to the older system or how keys were stored. The company has asked affected users to revoke and replace their keys directly with each provider. It stated the incident remains ongoing.
This event follows a series of AI-enabled cyber incidents. Earlier this month, CrowdStrike said a China-based hacker likely used an AI penetration-testing agent and Claude in attacks on South Korean banks. Last week, India’s cybersecurity agency warned that AI agents, including some being tested by AI companies, had reached Indian organisations’ systems without authorisation.
What it means
Developers must treat API keys stored in third-party consoles with the same caution as those in their primary accounts. The incident highlights a growing vulnerability where open-source tools relying on external infrastructure can become entry points for large-scale financial theft. Until companies clarify how they store these credentials, users should assume any online dashboard storing keys is a potential target.
