OpenCode, an open-source AI coding agent that has gained popularity among developers as an alternative to tools like Claude Code and Cursor, announced on Saturday that attackers had breached an older system overnight. The incident affected 1.4% of the users of its online platform, OpenCode Console—a platform where some users store API keys or digital credentials used to access AI services.
The struggle of the OpenCode team to keep pace with the attack highlights a growing, broader issue: companies that lack authorized access to less-restricted AI models—often due to regulatory or safety-related vetting—may find it difficult to defend against large-scale, AI-driven cyberattacks.
“Last night, we experienced a security breach involving a large-scale data distillation attack, affecting 1.4% of OpenCode Console users,” the company stated on X. “We have notified all affected users via email this morning.” Users who did not receive an email were not impacted, the company added.
While the company did not provide specific details on how the “data distillation” attack was executed, leaked API keys could theoretically enable users in regions without access to certain U.S.-based AI models to generate the massive volumes of output data required for such a process. Some skeptics, however, find this explanation far-fetched, arguing that the incident may simply be a conventional data breach, with the claim regarding “data distillation” remaining unverified.
Overnight, developers began posting alerts on Reddit and X regarding unexpected usage spikes and unauthorized charges. “Before going to bed, I saw usage alerts for my OpenAI, Anthropic, and Google AI accounts all going off—I had no idea what was happening,” one developer wrote.
Other users reported individual account charges reaching hundreds of dollars, with a few noting that total costs exceeded $1,000.
Anthropic and Google have both blocked the API keys they identified as compromised. OpenAI stated that it has worked with OpenCode to restore access and has issued refunds for the API credits consumed during the attack. OpenCode indicated that the process of refunding unauthorized charges is currently underway.
The leaked keys were limited to the Console, with some users employing them within their workspaces. Co-founder Dax Raad stated that open-source applications and command-line tools remain unaffected. On X, he wrote: “Please note—this is the OpenCode Console, not OpenCode itself; these keys were never in our possession.”
Even as users and AI companies took steps to disable the compromised keys, the OpenCode team remained under immense pressure. Raad noted that attackers had been attempting to breach their systems continuously for 48 hours, forcing the team to keep AI-driven defensive agents running around the clock. At one point, the AI models used by the OpenCode team for analysis were functioning as intended—but they ceased to operate once the malicious code they were tasked with examining triggered security filters.
“It’s a bit frustrating,” he wrote on X.
OpenCode subsequently gained access to OpenAI’s “Daybreak Blue” project, which provides vetted users with AI models less likely to refuse the execution of defensive security tasks. According to Raad, this access enhanced the team’s ability to investigate the attack.
OpenCode is not the first company to face such a dilemma. In July, the AI platform Hugging Face reported that its attempts to analyze logs of an intrusion by autonomous AI agents were thwarted by commercial AI models. OpenAI later disclosed that these agents were, in fact, its own models, which had been operating with reduced safety guardrails during testing. In a blog post titled “The Asymmetry Problem,” Hugging Face noted that security guardrails “cannot distinguish between an incident responder and an attacker.”
Security researchers have raised similar concerns, pointing out that these restrictions are inconsistent—a situation that has driven some to turn to foreign open-weight models, which can be downloaded and run by anyone.
The incident, which occurred over the weekend, drew a response from David Sachs, co-chair of the President’s Council of Advisors on Science and Technology.
“OpenCode (and earlier, Hugging Face) ran into the same problem during an attack: frontier models refused to analyze the exploits needed for defense because the payloads triggered safety filters. These guardrails are counterproductive,” he wrote on X.
The security breach took place on the same evening that OpenCode made its GLM-5.3-Flash model available to users for free. The GLM-5.3 series has already drawn the attention of scholars who study open-weight models, as its cybersecurity capabilities appear to approach levels previously seen only in restricted-access models, such as Anthropic’s “Claude Mythos Preview.”
OpenCode has not provided specific details regarding how the attackers gained access to legacy systems, how the API keys were stored, or the full extent of the misuse. The company has advised affected users to revoke and replace their keys directly through their respective key providers. It stated that the situation is still being addressed.
This security breach comes amid a broader surge in cybersecurity incidents involving artificial intelligence (AI). Earlier this month, cybersecurity firm CrowdStrike stated that a Chinese hacker may have leveraged an AI penetration-testing agent—designed to probe computer systems for vulnerabilities—to attack several banks in South Korea. Last week, Indian cybersecurity authorities warned that various AI agents—including those currently being tested by AI companies—had gained unauthorized access to the systems of businesses in India.