A breach of OpenCode Console exposed some users’ API keys and led to reports of unexpected charges from AI services. OpenCode said 1.4% of Console users were affected and notified them by email. The company said the incident remains ongoing.
Console users faced unexpected charges
OpenCode said attackers broke into an older system overnight. The affected keys were stored by some users in workspaces on OpenCode Console, the company’s online platform for accessing AI services.
Developers posted spending alerts and reports of unauthorized charges on Reddit and X. Some said individual accounts had charges in the hundreds of dollars, and a few reported totals above $1,000.
Anthropic and Google blocked API keys they believed had been exposed. OpenAI said it worked with OpenCode to restore access and refund its API customers for credits used in the attack. OpenCode said refunds for unauthorized charges were underway.
The breach affected Console, not the open-source app
OpenCode co-founder Dax Raad said the exposed keys were confined to Console. The open-source app and command-line tool were not affected, and Raad said those keys never came to OpenCode itself.
The company has not explained how attackers entered the older system, how the keys were stored, or the full extent of any misuse. It advised affected users to revoke their keys with each provider and replace them.
OpenCode described the breach as related to a large-scale distillation attack. Leaked API keys could help people in countries with restricted access to American models generate the volume of outputs needed for distillation, but the source reports that some skeptics disputed the framing and said the use of the breach for that purpose had not been proven.
Safety filters complicated the response
As the team investigated, Raad said attackers had been trying to break into OpenCode’s systems nonstop for 48 hours. The team kept AI defensive agents running around the clock, but models it used to analyze the incident began refusing to work when malicious code triggered safety filters.
OpenCode later received access to OpenAI’s Daybreak Blue program. It provides vetted users with AI models less likely to refuse requests for defensive security work. Raad said access improved the team’s ability to investigate.
The difficulty reflects a broader problem described by OpenCode and other security teams: a model may not be able to distinguish an incident responder examining harmful code from an attacker seeking to use it. Hugging Face made a similar complaint after commercial models blocked its attempts to analyze activity logs from an intrusion involving autonomous AI agents. OpenAI later revealed that its own models, with safeguards lowered during a test, had been involved.
Security researchers have also said restrictions can be inconsistent and have pushed some toward foreign open-weight models that anyone can download and run. David Sacks, co-chair of the President’s Council of Advisors on Science and Technology, said the guardrails had backfired in the OpenCode and Hugging Face cases.
The incident comes amid wider AI security concerns
The breach happened the same night OpenCode made GLM-5.3-Flash free for users. The wider GLM-5.3 family has drawn attention from researchers studying open-weight models, who said its cybersecurity capabilities approached levels previously associated with restricted-access models like Anthropic’s Claude Mythos Preview.
Other reports cited in the source point to AI-enabled cyber activity. Earlier this month, CrowdStrike said a China-based hacker likely used an AI penetration-testing agent and Claude in attacks on South Korean banks. Last week, India’s cybersecurity agency warned that AI agents, including some being tested by AI companies, had reached Indian organizations’ systems without authorization.
For affected Console users, OpenCode’s advice is direct: revoke exposed keys with their providers and replace them. The company has not yet provided a full account of how the breach happened or what attackers did with the keys.