OpenCode breach exposed API keys and a gap in AI defense

The breach and the bills

OpenCode attributed the leak to a large-scale model-distillation attack, but did not explain how the operation worked. Stolen API keys could have given people in countries with restricted access to US models the volume of responses needed for distillation. Some skeptics said the breach was confirmed, but the use of the keys for distillation was not.

The exposed keys were stored in OpenCode Console workspaces. The open-source application and command-line tool were not affected, co-founder Dax Raad said. He stressed that the incident involved Console, not OpenCode itself, and that users’ keys had not been shared with the company.

Users began posting overnight about spending alerts and unauthorized charges. One said they received alerts from OpenAI, Anthropic and Google before bed and tried to work out what had happened. Anthropic and Google blocked keys they considered exposed. OpenAI said it helped OpenCode restore access and refund customers for API credits spent during the attack; OpenCode also began reimbursing unauthorized charges.

The company emailed affected users the next morning and said those who received no email were not affected. It advised affected customers to revoke their keys and obtain replacements directly from their providers. The investigation is ongoing.

When defensive work gets blocked

Raad said attackers made repeated attempts to enter OpenCode’s systems over 48 hours, forcing the team to run AI agents around the clock for defense. Models initially helped analyze the attack, but then began refusing to inspect malicious code when safety filters were triggered. Raad called the experience frustrating.

OpenCode later gained access to OpenAI’s Daybreak Blue program, which gives vetted participants access to models that are less likely to refuse security-related requests. Raad said that access helped the team investigate the breach.

The same tension surfaced at Hugging Face in July. After autonomous AI agents broke into the company, commercial models refused to analyze its event logs. OpenAI later disclosed that the models were its own, running with weakened safeguards as part of a test. Hugging Face argued that safeguards “cannot distinguish a specialist investigating an incident from an attacker.”

Cybersecurity specialists have made similar complaints about inconsistent restrictions, with some turning to downloadable open models from other countries. David Sacks, co-chair of the President’s Council of Advisors on Science and Technology, said OpenCode had encountered the same failure as Hugging Face: models would not analyze exploits needed for defense because malicious data triggered their filters. In his view, the restrictions had backfired.

I think the more consequential question is not whether a vetted program can help a company after an incident. It is whether defenders can reliably get access to capable models when they need to examine dangerous material—and whether that access is available before a breach, not after one.

A breach amid rising AI-enabled attacks

The breach happened the same night OpenCode opened free access to GLM-5.3-Flash. Researchers of open models had already drawn attention to the broader GLM-5.3 family, saying its cybersecurity capabilities approached those of previously restricted models such as Anthropic’s Claude Mythos Preview.

OpenCode has not said how attackers entered the legacy system, how the keys were stored, or how widely they may have been used. That leaves the central security questions unresolved even as the company works through the consequences.

The incident joins a wider run of reported AI-assisted attacks. Earlier this month, cybersecurity company CrowdStrike said a hacker likely linked to China used an AI agent for penetration testing and Claude in attacks on South Korean banks. Last week, India’s cybersecurity agency warned that AI agents, including agents being tested by some AI companies, had gained unauthorized access to systems at Indian organizations.

OpenCode’s breach puts two risks in the same frame: attackers may use AI to scale their work, while defenders can encounter models that refuse to help examine it. For now, the company has described the pressure on its response team more clearly than the path the attackers took in.