OpenCode, an open source AI coding agent, said on Saturday that attackers broke into an older system overnight. The company wrote on X that the breach affected 1.4% of users of OpenCode Console, its online platform, where some users keep the API keys they use to reach AI services. It emailed everyone affected that morning, and says users who received no email were not impacted.
What was exposed
The exposed keys were limited to Console workspaces. Co-founder Dax Raad said the open source app and the command-line tool were not affected, and that keys used there never reach OpenCode.
Developers reported spend alerts from OpenAI, Anthropic and Google firing overnight. Some reported charges in the hundreds of dollars on a single account, and a few reported totals above $1,000. Anthropic and Google blocked the keys they believed were exposed. OpenAI said it worked with OpenCode to restore access and would refund its API customers for credits used in the attack. OpenCode says refunds for unauthorized charges are underway.
What is still unclear
OpenCode described the incident as tied to a large-scale distillation attack. It did not explain how that worked. Some skeptics called the framing an overstretch and said it was a plain breach, with use for distillation unproven. The company has also not said how attackers got into the older system, how the keys were stored, or how far the misuse went. It describes the incident as ongoing.
Affected users have been told to revoke their keys and replace them directly with each provider.
The defence problem
Raad said attackers had been trying to get into OpenCode's systems nonstop for 48 hours, so the team kept AI defensive agents running around the clock. The AI models it used to analyse the attack helped for a while, then began refusing when the malicious code tripped their safety filters. OpenCode later got access to OpenAI's Daybreak Blue program, which gives vetted users models less likely to refuse defensive security work. Raad said that improved the team's ability to investigate.
The source notes that Hugging Face reported something similar in July, when commercial models blocked it from analysing logs from an intrusion.
What to do now
- Find out whether your team used OpenCode Console and whether anyone received the notification email.
- Revoke and replace any key that was stored there, at each provider.
- Check provider billing for unexpected usage and turn on spend alerts where they are not set.
- Inventory where other provider keys are stored in third-party hosted tools.