OpenCode, an open-source AI coding agent gaining ground as an alternative to Claude Code and Cursor, said Saturday that attackers broke into an older system overnight, affecting 1.4% of users of OpenCode Console, its online platform where some users store API keys for AI services. The company described the incident as related to a large-scale distillation attack, but did not specify how it occurred; leaked keys, it said, can help users in countries with restricted access to American models produce the high output volumes distillation requires. Developers soon posted spending alerts and unauthorized charges on Reddit and X, with some reporting hundreds of dollars in charges and a few totals above $1,000. Anthropic and Google blocked the API keys they believed were exposed, while OpenAI said it worked with OpenCode to restore access and refund API customers for credits used in the attack. OpenCode said refunds for unauthorized charges are underway. Some skeptics called the distillation framing an overstretch, arguing that the incident was a straightforward breach whose use for distillation remains unproven.

The exposed keys were confined to Console, according to co-founder Dax Raad, who said the open-source app and command-line tool were not affected and that the keys never reach OpenCode. The company has not detailed how attackers gained access, how keys were stored, or the full extent of misuse; it told affected users to revoke and replace keys with each provider and said the incident remains ongoing.

The scramble to respond highlighted a growing problem: companies without vetted access to less restricted AI models have a hard time defending against large-scale AI-driven attacks. Raad said attackers tried to break into OpenCode‘s systems nonstop for 48 hours, and the team kept AI defensive agents running around the clock. The AI models used for analysis helped at first but began refusing when malicious code they were asked to examine activated safety filters. OpenCode later received access to OpenAI’s Daybreak Blue program, which gives vetted users models less likely to refuse defensive security work, and Raad said that improved the investigation. The episode echoes Hugging Face‘s July intrusion, when commercial AI models blocked analysis of activity logs from autonomous AI agents; OpenAI later revealed those agents were its own models running with safeguards lowered during a test. Hugging Face wrote in a section titled “The asymmetry problem” that guardrails “cannot distinguish an incident responder from an attacker.” David Sacks, co-chair of the President’s Council of Advisors on Science and Technology, said OpenCode and Hugging Face hit the same wall because frontier models refused to analyze exploits needed for defense, adding: “The guardrails backfired.”

The breach happened the same night OpenCode made GLM-5.3-Flash free, and the GLM-5.3 family has drawn attention from researchers who study open-weight models because its cybersecurity capabilities approached levels previously associated with restricted-access models like Anthropic’s Claude Mythos Preview. The incident also fits into a series of AI-enabled cyber events: CrowdStrike said a China-based hacker likely used an AI penetration-testing agent and Claude in attacks on South Korean banks, and India’s cybersecurity agency warned that AI agents, including some being tested by AI companies, reached Indian organizations’ systems without authorization.