OpenCode, an open-source AI coding agent gaining traction among developers as an alternative to Claude Code and Cursor, announced Saturday that attackers had breached an older system overnight, impacting 1.4% of users on its online platform, OpenCode Console. This platform is where some users store the API keys—digital passwords used to access AI services. The incident underscored a growing challenge: companies lacking vetted access to AI models with fewer safety restrictions struggle to defend against large-scale, AI-driven cyberattacks, a problem made evident as the OpenCode team scrambled to keep up with the assault.

"We had a security breach last night related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users," the company posted on X. "We have notified them all this morning via email." Users who did not receive an email were not affected, according to the company. While OpenCode did not specify how the distillation attack occurred, leaked API keys can enable users in countries with restricted access to American models to generate the high volume of outputs required for such a process. Some skeptics dismissed this framing as an overreach, contending that the incident was a straightforward breach whose connection to distillation remains unproven.

Overnight, developers began sharing spending alerts and unauthorized charges on Reddit and X. "I saw my Open AI, Anthropic, and Google AI spend alerts all fire off before going to bed wondering what was going on," one developer wrote. Other users reported charges amounting to hundreds of dollars on individual accounts, with a few describing totals exceeding $1,000. Anthropic and Google both blocked the API keys they believed were exposed, while OpenAI stated it worked with OpenCode to restore access and refund its API customers for credits used in the attack. OpenCode said refunds for unauthorized charges are in progress.

The exposed keys were limited to Console, where some users had stored them in workspaces. The open-source app and command-line tool were not affected, according to co-founder Dax Raad. "Note this is the OpenCode Console, not OpenCode itself, those keys never come to us," he wrote on X. Even as users and AI companies moved to disable the exposed keys, the OpenCode team remained under pressure. Raad said attackers had been attempting to break into its systems nonstop for 48 hours, forcing the team to keep AI defensive agents running around the clock. AI models the OpenCode team turned to for analysis helped for a while but began refusing to work when the malicious code they were asked to examine triggered safety filters. "[T]hat was a bit frustrating," he wrote on X. OpenCode later gained access to OpenAI's Daybreak Blue program, which provides vetted users with AI models less likely to refuse requests for defensive security work. Raad said the access improved the team's ability to investigate the attack.

OpenCode is not the first company to encounter this obstacle. In July, AI platform Hugging Face reported that commercial AI models blocked its attempts to analyze activity logs from an intrusion by autonomous AI agents—which OpenAI later revealed were its own models running with safeguards lowered during a test. In a section of its blog post titled "The asymmetry problem," Hugging Face wrote that guardrails "cannot distinguish an incident responder from an attacker."

Security researchers have voiced similar complaints, saying the restrictions are inconsistent and have pushed some toward foreign open-weight models, which anyone can download and run. The weekend episode drew a response from David Sacks, co-chair of the President's Council of Advisors on Science and Technology. "OpenCode (and earlier Hugging Face) hit the same wall mid-attack: frontier models refused to analyze the very exploits needed for defense because the payloads tripped safety filters. The guardrails backfired," he wrote on X.

The breach occurred the same night OpenCode made GLM-5.3-Flash free for users. The broader GLM-5.3 family has attracted attention from researchers who study open-weight models, noting that its cybersecurity capabilities approached levels previously associated with restricted-access models like Anthropic's Claude Mythos Preview. OpenCode has not detailed how attackers gained access to the older system, how keys were stored, or the full extent of any misuse. It has advised affected users to revoke and replace their keys directly with each provider. The company said the incident remains ongoing.

The breach arrives amid a series of AI-enabled cyber incidents. Earlier this month, cybersecurity firm CrowdStrike reported that a China-based hacker likely used an AI penetration-testing agent—which probes computer systems for weaknesses—and Claude in attacks on South Korean banks. Last week, India's cybersecurity agency warned that AI agents, including some being tested by AI companies, had reached Indian organizations' systems without authorization.