OpenCode, an open source AI coding agent that has been gaining ground as an alternative to Claude Code and Cursor, said on Saturday, October 17, that attackers broke into an older system overnight, affecting 1.4% of users of its online platform, OpenCode Console. Some Console users store the API keys they use to reach AI providers there. Users reported unexpected charges that, in some cases, ran into hundreds or even more than a thousand dollars. TechCrunch reported the incident on October 19; OpenCode says it is still ongoing.

What happened

OpenCode wrote on X that it “had a security breach last night related to a large-scale distillation attack” that affected 1.4% of Console users, all of whom were emailed the next morning; anyone who did not receive an email was not affected. The company has not said how the distillation attack worked. Distillation means collecting a model’s outputs at volume to train another model, and leaked API keys can help people in countries with restricted access to American models generate the high volume of output that requires. Some skeptics called that framing an overstretch, arguing the episode was a straightforward breach and that its use for distillation is unproven. We could not verify either view.

Overnight, developers posted spending alerts and unauthorized charges on Reddit and X. One wrote that their OpenAI, Anthropic and Google AI spend alerts all fired before bedtime. Other users reported charges in the hundreds of dollars, and a few described totals above $1,000.

Which parts were affected

Co-founder Dax Raad stressed that the exposed keys were confined to the Console, “not OpenCode itself”, and that those keys never reach the project. The open source app and command-line tool were not affected, according to the company. OpenCode has not detailed how the attackers entered the older system, how keys were stored there, or the full extent of misuse, and it has told affected users to revoke and replace their keys directly with each provider.

How providers responded

Anthropic and Google blocked the API keys they believed were exposed. OpenAI said it worked with OpenCode to restore access and refund its API customers for credits used in the attack. OpenCode says refunds for unauthorized charges are underway. The breach happened the same night OpenCode made GLM-5.3-Flash free for users, and TechCrunch notes that the wider GLM-5.3 family has drawn attention from researchers because its cybersecurity capabilities reportedly approached levels previously associated with restricted-access models such as Anthropic’s Claude Mythos Preview.

The defender’s problem

The episode also exposed a different issue. Raad said attackers had been trying to break into OpenCode’s systems nonstop for 48 hours, forcing the team to keep AI defensive agents running around the clock. The models they used for analysis helped for a while, but began refusing to work when the malicious code under examination triggered safety filters, which he called “a bit frustrating”. OpenCode later received access to OpenAI’s Daybreak Blue program, which gives vetted users models less likely to refuse defensive security work, and Raad said that improved the team’s investigation.

This is not new: in July, Hugging Face said commercial models blocked its attempts to analyze logs from an intrusion by autonomous AI agents, which OpenAI later said were its own models running with safeguards lowered during a test. David Sacks, co-chair of the President’s Council of Advisors on Science and Technology, argued on X that the guardrails backfired in both cases. Security researchers have complained that restrictions are inconsistent and some have turned to foreign open-weight models. The breach arrives amid other AI-enabled incidents, including a CrowdStrike report that a China-based hacker likely used an AI penetration-testing agent and Claude against South Korean banks, and a warning last week from India’s cybersecurity agency that AI agents had reached organizations’ systems without authorization.

What users should do

If you stored provider keys in OpenCode Console, revoke and rotate them at OpenAI, Anthropic, Google and any other provider, check billing dashboards for anomalies, and set hard spending limits where the provider allows. See our AI security checklist for small businesses for broader key-handling practices.

What to watch next

  • A fuller post-mortem from OpenCode on how the older system was breached.
  • Whether providers extend vetted “defensive” model access beyond a few programs.
  • A final tally of refunds and affected accounts.
  • Any evidence supporting or refuting the distillation explanation.
  • Whether other coding-tool vendors audit stored credentials.

Key takeaways

  • The breach hit an older OpenCode Console system and 1.4% of Console users.
  • The open source app and CLI were not affected, per OpenCode.
  • Anthropic and Google blocked exposed keys; OpenAI is refunding API customers.
  • Affected users must revoke and replace keys with each provider.
  • The “distillation attack” label is disputed and unproven.

Frequently asked questions

Do I need to act if I only use the OpenCode CLI?

OpenCode says the app and CLI were not affected. Only users who stored keys in the Console and were emailed are confirmed as affected.

Will I get my money back?

OpenCode says refunds for unauthorized charges are underway, and OpenAI said it will refund its API customers for credits used in the attack. Check with each provider.

What is a distillation attack?

It is the large-scale collection of a model’s outputs, here via stolen API keys, to train a rival model. Skeptics say that is not shown here.