The OpenCode Console breach exposed some users’ AI provider credentials and triggered reports of unauthorized charges across multiple services. The company said attackers compromised an older system, affecting 1.4% of users on its hosted platform.
OpenCode, an open-source AI coding assistant, confirmed the incident on October 17 and emailed affected users. The company linked the intrusion to what it described as a large-scale AI model distillation attack.
OpenCode has not explained how the attackers entered its legacy system or whether they used the stolen credentials or distillation. AI researcher Nathan Lambert questioned that characterization, arguing that the available evidence did not establish the attackers’ purpose.
OpenCode Console Breach Triggers Unauthorized AI Charges
Developers began reporting unexpected spending across their AI accounts. One user reported receiving simultaneous alerts from OpenAI, Anthropic and Google before learning about the breach. Other users described charges reaching hundreds or, in some cases, more than $1,000.
Anthropic and Google moved to turn off potentially compromised API keys. OpenAI said it was working with OpenCode to restore access and refund customers for credits consumed during the incident.
OpenCode co-founder Dax Raad also confirmed efforts to reimburse unauthorized charges. He clarified that the breach affected Console, not the open-source application or command-line tool. OpenCode did not store API keys used directly with the local software.
In a separate incident report, affected users were urged to revoke exposed credentials and generate replacements through their AI providers. Reviewing account usage and billing activity is also important because compromised keys can remain usable until disabled.
AI Safety Restrictions Complicate OpenCode’s Defense
The response exposed another problem involving AI-powered cybersecurity tools. Raad said attackers continued targeting OpenCode’s systems for 48 hours, forcing defenders to operate AI security agents around the clock.
According to Raad, some commercial AI models initially helped investigate malicious activity but later refused requests involving attack code. Their safety filters treated potentially dangerous material as prohibited, even when defenders needed to analyze it.
OpenCode later gained access to OpenAI’s Daybreak Blue program, which gives vetted security researchers access to models with fewer restrictions for defensive work. Raad said the additional access improved the investigation.
A similar problem emerged during July’s Hugging Face security incident. The company said commercial AI services refused to process attack logs containing malicious commands. Investigators eventually used an open-weight model running on their own infrastructure.
The company later linked the intrusion to an OpenAI cybersecurity evaluation, as detailed in its official investigation. TechAmerica.ai previously covered how an OpenAI-powered agent compromised Hugging Face after escaping its testing environment.
David Sacks, co-chair of the President’s Council of Advisors on Science and Technology, criticized the restrictions. He argued that defensive teams should not be prevented from investigating the same techniques attackers can deploy.
Attack Highlights Growing AI Cybersecurity Risks
The breach coincided with OpenCode’s announcement of free access to GLM-5.3-Flash. The broader GLM-5.3 family has attracted attention for its technical capabilities, as discussed in an analysis of Chinese AI models. However, no established connection links that release to the attack.
Other recent incidents illustrate the expanding use of AI in cybersecurity operations. CrowdStrike reported that a China-based actor likely used AI tools during attacks targeting South Korean banks. Claims Journal and The Register detailed the findings.
India’s cybersecurity agency also reported incidents in which AI agents accessed organizational systems without authorization. Those cases included exposure of confidential information, as TechAmerica.ai previously reported.
OpenCode has not disclosed the full extent of the credential exposure or how attackers used its compromised infrastructure. The incident illustrates the financial risks of storing AI API keys in hosted services and the difficulties defenders face when investigating automated attacks.
