OpenCode, the open source AI coding agent, said on Saturday that attackers broke into an older system overnight, affecting 1.4 percent of users of OpenCode Console, its online platform where some users store the API keys they use to reach AI services. The company notified affected users by email on Sunday morning and said users who received no email were not impacted.
Developers posted spending alerts as the exposed keys were used: one wrote that OpenAI, Anthropic and Google spend alerts all fired before bed. Individual charges ran into the hundreds of dollars, with a few above 1,000 dollars. Anthropic and Google blocked keys they believed were exposed, OpenAI worked with OpenCode to restore access and refund credits used in the attack, and OpenCode said refunds for unauthorised charges are underway. Co founder Dax Raad stressed the exposure was confined to Console workspaces: the open source application and command line tool were not affected, and those keys never reach OpenCode itself.
OpenCode described the incident as a large scale distillation attack, a use leaked keys would suit, since generating model outputs at volume is how a rival model gets trained on another’s behaviour. TechCrunch noted sceptics who called that framing an overstretch for a straightforward breach whose purpose remains unproven.
The response ran into a defensive wall. Raad said attackers probed the systems nonstop for 48 hours, and the AI models the team first used to analyse the attack began refusing once the malicious code activated safety filters. Access to OpenAI’s Daybreak Blue programme, which gives vetted users models less likely to refuse defensive security work, improved the investigation. Hugging Face reported the same problem in July, writing that guardrails cannot distinguish an incident responder from an attacker.