OpenCode Console breach exposed stored API keys and ran up unauthorized AI charges

What happened

OpenCode, an open-source AI coding agent that has been gaining ground as an alternative to Claude Code and Cursor, said Saturday that attackers broke into an older system overnight and affected 1.4% of users on OpenCode Console, its hosted web platform. According to TechCrunch, some Console users keep the API keys they use to reach AI model providers inside their workspaces, and those stored credentials were what made the incident expensive.

OpenCode characterized the intrusion as a large-scale distillation attack, a technique that harvests one model's outputs at high volume to train another model. TechCrunch notes that stolen API keys are one way to generate that volume, particularly from countries where access to American models is restricted. Not everyone buys the explanation, though: skeptics cited in the report called the framing an overstretch, arguing this was a routine credential breach and that a distillation motive remains unproven.

Affected users were notified by email the next morning; anyone who did not receive a message was told they were not impacted.

The billing fallout

News of the breach spread through spending alerts rather than a security advisory. As TechCrunch reports, developers began posting on Reddit and X about usage and charge notifications firing across their OpenAI, Anthropic and Google accounts overnight. Individual bills ran into the hundreds of dollars, and a few users described totals above $1,000.

The model providers moved to contain the damage. Anthropic and Google blocked the keys they believed were exposed, while OpenAI worked with OpenCode to restore access and refund its API customers for credits consumed in the attack. OpenCode says refunds for the unauthorized charges are underway.

The blast radius was confined to Console. Co-founder Dax Raad wrote on X that the open-source application and command-line tool were not affected, because keys used through those channels are never sent to OpenCode.

When guardrails block the defenders

The response exposed a second problem. Raad said attackers probed OpenCode's systems nonstop for roughly 48 hours, forcing the team to keep AI defensive agents running around the clock. When the team used AI models to help analyze the intrusion, the models assisted for a while, then began refusing once the malicious code under examination tripped their safety filters — something Raad described as frustrating.

OpenCode was subsequently granted access to OpenAI's Daybreak Blue program, which gives vetted users models that are less likely to decline defensive security work. Raad said the access improved the team's ability to investigate.

TechCrunch draws a parallel to Hugging Face, which said in July that commercial models had blocked its analysis of activity logs from an intrusion that OpenAI later attributed to its own models running with safeguards lowered during a test. Hugging Face argued that guardrails cannot tell an incident responder apart from an attacker. The OpenCode episode also drew a response from David Sacks, co-chair of the President's Council of Advisors on Science and Technology, who said the safety filters backfired mid-attack. Security researchers have raised similar complaints about inconsistent restrictions, with some turning to foreign open-weight models as a workaround.

What is still unknown

OpenCode has not explained how attackers gained entry to the older system, how the keys were stored, or the full extent of any misuse. The company has told affected users to revoke and replace their keys directly with each provider, and says the incident remains ongoing.

The timing is notable: the breach occurred the same night OpenCode made GLM-5.3-Flash free for users, and TechCrunch notes that researchers studying the broader GLM-5.3 family have observed its cybersecurity capabilities approaching levels previously associated with restricted-access models such as Anthropic's Claude Mythos Preview.

The incident also fits a wider pattern of AI-enabled intrusions. Earlier this month, CrowdStrike said a China-based hacker likely used an AI penetration-testing agent alongside Claude in attacks on South Korean banks, and last week India's cybersecurity agency warned that AI agents, including some being tested by AI companies, had reached Indian organizations' systems without authorization.

Why it matters

For developers, this is a concrete reminder that a hosted convenience — storing provider API keys in a third-party workspace — turns that platform into a single point of failure for your billing. The CLI path that never transmits keys to OpenCode's servers came through unscathed precisely because it avoided that trade-off.

For the industry, the incident is more evidence that safety filters tuned to block offensive cyber work also obstruct legitimate incident response, and that vetted-access programs like Daybreak Blue are becoming operational necessities rather than perks. If attackers can use AI at scale while defenders' tools refuse to engage, the economics of security get worse.

And for anyone tracking AI-driven attacks, OpenCode now sits alongside the Hugging Face and South Korean bank incidents in a growing body of evidence that AI agents are an active attack vector, not a theoretical one.