OpenCode, an AI-powered open-source coding assistant seen as a competitor to tools like Claude Code and Cursor, has disclosed a security breach affecting its OpenCode Console. Attackers accessed an older system and compromised API keys stored by users, leading to unauthorized spending across AI accounts. Around 1.4% of users were impacted, the company confirmed.
What Happened
The breach stemmed from what OpenCode described as a “large-scale distillation attack” involving leaked API keys. These keys—digital credentials used to access third-party AI services—were stored in Console workspaces and improperly accessed overnight, though the more recent open-source app and command-line tools were unaffected. OpenCode alerted all users who may have been impacted.
Damage and Response
Users reported receiving alerts across Reddit and X about suspicious activity, with some noting unexpected charges for OpenAI, Anthropic, and Google AI usage. Individual accounts logged costs in the hundreds, and in some cases, climbed above $1,000. In response, Anthropic and Google blocked the exposed keys, while OpenAI collaborated with OpenCode to reinstate access and refund credits misused during the breach. Refunds from OpenCode are in progress.
Throughout the ordeal, OpenCode’s security team faced repeated intrusion attempts over a 48-hour stretch, deploying AI defensive agents nonstop. However, these tools ran into safety filters that triggered when asked to analyze parts of the malicious payloads—compromising the investigation in some respects. To help with the response, OpenCode gained access to OpenAI’s Daybreak Blue program, which grants vetted users access to models with fewer usage restrictions.
Bigger Picture Risks
This incident underscores a broader cybersecurity quandary: models designed with strict safety guardrails sometimes block legitimate defense efforts during active attacks. OpenCode isn’t alone in encountering this issue. Previously, Hugging Face revealed it grappled with similar limitations when trying to inspect autonomous AI agents involved in a security breach. Security experts note that these constraints are pushing some teams toward using open-weight models that, while more accessible for investigation, often carry other trade-offs.
In parallel with the breach, OpenCode rolled out free access to its GLM-5.3-Flash model. The GLM-5.3 family has caught attention among researchers, especially for its proximity in performance to more restricted or commercial models such as Anthropic’s Claude Mythos Preview.
OpenCode has not yet revealed how attackers gained entry to the older system, exactly how API keys were stored, or the full scope of misuse. Affected users have been advised to revoke and replace impacted keys directly with service providers. The investigation remains ongoing.
As AI becomes increasingly embedded in workflows, incidents like this one raise urgent questions about how safety-based guardrails are defined and deployed—especially when they interfere with defense actions during breaches. This particular breach exposes the pressure points in current AI security strategies.
Why It Matters: When an AI model’s safety mechanisms block defenders, it’s not just a technical glitch—it becomes a strategic vulnerability. Going forward, enterprises and developers will have to rethink how much autonomy models get, especially during incidents. Watch for changes in how AI platforms balance safety and transparency, potentially impacting access to tools like open-weight models.
