OpenCode, an open source AI coding agent, reported a security breach Saturday impacting 1.4 percent of its OpenCode Console users. Attackers gained access to an older system overnight, compromising API keys that provide access to various AI services.
The breach led to unauthorized charges on developer accounts across multiple AI platforms. Users reported spending alerts and charges ranging from hundreds of dollars to over $1,000 on individual accounts, specifically for OpenAI, Anthropic and Google AI services.
The company described the incident as a "large-scale distillation attack." While OpenCode did not detail the attack's mechanics, compromised API keys can enable users in regions with restricted access to generate the high volume of outputs necessary for such distillation processes.
Anthropic and Google responded by blocking the API keys they believed were exposed. OpenAI collaborated with OpenCode to restore access for affected users and issued refunds for credits consumed during the attack. OpenCode has stated that refunds for all unauthorized charges are being processed.
Co-founder Dax Raad confirmed that the exposed keys were limited to workspaces within the OpenCode Console. The core open source application and command-line tool remained unaffected, as user keys for these tools are not stored on OpenCode's systems.
The OpenCode team faced continuous pressure, with attackers attempting to breach its systems for 48 consecutive hours. The company deployed AI defensive agents to counter the ongoing assault, running them around the clock.
During the defense, AI models tasked with analyzing malicious code began refusing requests, triggering their built-in safety filters. Raad noted this operational hurdle, describing it as "frustrating" for the security team.
OpenCode later secured access to OpenAI's Daybreak Blue program. This initiative provides vetted users with AI models designed to be less prone to refusing requests when engaged in defensive security operations, offering a tool for combating sophisticated cyber threats.
Some skeptics argue the incident was a straightforward breach, contending that framing it as a distillation attack overstates the evidence and that the specific use of compromised keys for distillation remains unproven.
The incident exposes a real constraint for companies without direct access to less restricted AI models for security purposes. When standard AI safety filters block security analysis during an active attack, it creates operational friction that better-capitalized competitors—or those with direct vendor relationships—can avoid.
