OpenCode Security Breach Exposes API Keys as Hackers Run Up $1,700 in Unauthorized Charges

OpenCode Console Breach Affects 1.4% of Users

OpenCode, an open-source AI coding agent gaining traction as an alternative to Claude Code and Cursor, disclosed a security breach on Saturday that impacted 1.4% of users on its hosted platform, OpenCode Console1

1

. The attack targeted a legacy system overnight on October 16, potentially exposing API keys that users had stored for accessing AI services from OpenAI, Anthropic, and Google2

2

. All affected users received email notifications on the morning of October 17 under the subject line "Action Required: Potential provider key breach," while those who didn't receive the message were confirmed unaffected2

2

.

Unauthorized Charges Reach $1,700 for Some Developers

Developers quickly reported unauthorized charges on their AI accounts across multiple platforms. Preston Zeller documented losses of $1,700, while Colin Parsons faced $281 in OpenAI charges and $168 on Anthropic2

2

. Other users described charges in the hundreds of dollars, with some Reddit users reporting approximately $400 in unauthorized Anthropic usage and €200 in Google usage2

2

. "I saw my Open AI, Anthropic, and Google AI spend alerts all fire off before going to bed wondering what was going on," one developer wrote1

1

. Several users also reported that Google suspended their projects after detecting "abusive activity consistent with hijacked resources"3

3

.

Large-Scale Distillation Attack Targets AI Provider Keys

OpenCode characterized the incident as "related to a large-scale distillation attack," though the company hasn't specified how the attack occurred or proven the connection between the breach and distillation1

1

. Distillation is a machine-learning technique where smaller AI models are trained using responses from more powerful models, creating cheaper and faster alternatives3

3

. The technique becomes an attack when it involves unauthorized queries at scale. Leaked API keys can help users in countries with restricted access to American models generate the high volume of outputs needed for this process1

1

. Some skeptics called the framing an overstretch, arguing the incident was a straightforward breach whose use for distillation remains unproven1

1

.

Exposed Keys Limited to Console, Not Open-Source App

The exposed OpenAI, Anthropic, and Google API keys were confined to OpenCode Console, where some users stored them in workspaces1

1

. Console is OpenCode's optional hosted service where workspaces save third-party AI provider keys, allowing team members to use models without seeing the credentials directly2

2

. Co-founder Dax Raad clarified that "this is the OpenCode Console, not OpenCode itself, those keys never come to us"1

1

. The open-source app and command-line tool, which store provider keys locally in a SQLite database on users' machines, were not affected2

2

.

AI Safety Filters Block Defensive Security Analysis

As hackers hit the AI coding tool with continuous cyberattacks for 48 hours, the OpenCode team faced an unexpected obstacle3

3

. AI models the team used for analysis initially helped but started refusing to work when the malicious code they examined activated safety filters. "[T]hat was a bit frustrating," Raad wrote on X1

1

. The situation improved after OpenCode received access to OpenAI's Daybreak Blue program, which provides vetted users with AI models less likely to refuse requests for defensive security work1

1

. This highlighted a growing asymmetry problem where companies without vetted access to AI models with fewer safety restrictions struggle to defend against large-scale, AI-driven cyberattacks1

1

.

Industry Pattern Emerges Around AI Defense Limitations

OpenCode isn't the first company to encounter this wall. In July, AI platform Hugging Face reported that commercial AI models blocked attempts to analyze activity logs from an intrusion by autonomous AI agents, which OpenAI later revealed were its own models running with safeguards lowered during a test1

1

. In a blog post section titled "The asymmetry problem," Hugging Face wrote that guardrails "cannot distinguish an incident responder from an attacker"1

1

. Security researchers have raised similar complaints, noting that restrictions are inconsistent and have pushed some toward foreign open-weight models that anyone can download and run1

1

. David Sacks, co-chair of the President's Council of Advisors on Science and Technology, responded to the weekend episode: "OpenCode (and earlier Hugging Face) hit the same wall mid-attack: frontier models refused to analyze the very exploits needed for defense because the payloads tripped safety filters. The guardrails backfired"1

1

.

Providers Block Keys and Issue Refunds

Anthropic and Google both blocked the API keys they believed were exposed in the OpenCode Console breach, while OpenAI worked with OpenCode to restore access and refund its API customers for credits used in the attack1

1

. OpenCode confirmed that refunds for unauthorized charges are underway1

1

. The company instructed affected users to revoke and replace their keys directly with each provider following specific guidance from OpenAI, Anthropic, and Google2

2

. Users should also review usage and billing at each provider for unauthorized requests dating back to at least October 16, set spend limits or alerts, and give each tool its own key to minimize damage from future compromised credentials2

2

.

Timing and Broader Context of AI-Enabled Incidents

The breach occurred the same night OpenCode made GLM-5.3-Flash free for users1

1

. The broader GLM-5.3 family has drawn attention from researchers studying open-weight models, noting that its cybersecurity capabilities approached levels previously associated with restricted-access models like Anthropic's Claude Mythos Preview1

1

. The incident lands amid a run of AI-enabled cyber incidents. Earlier this month, cybersecurity firm CrowdStrike reported that a China-based hacker likely used an AI penetration-testing agent and Claude in attacks on South Korean banks1

1

. Last week, India's cybersecurity agency warned that AI agents, including some being tested by AI companies, had reached Indian organizations' systems without authorization1

1

. OpenCode has not detailed how attackers gained access to the legacy system, how keys were stored, or the full extent of any misuse, and the company said the incident remains ongoing1

1

.