A security breach at OpenCode potentially exposed API keys for OpenAI, Anthropic, and Google after attackers accessed a legacy system on October 16.
The intrusion affected 1.4% of OpenCode Console users, with several developers reporting unauthorized charges exceeding $1,000. Affected users were notified by email and instructed to revoke and replace their credentials directly with their AI providers.
OpenCode linked the breach to a suspected large-scale model distillation attack but has not explained the connection or confirmed how the credentials were used.
During the investigation, its security team encountered difficulties when commercial AI models refused to analyze malicious code because of safety restrictions. Access to OpenAI’s Daybreak Blue program later provided additional capabilities for defensive security work.
Why It Matters: The incident puts AI vendor security practices under scrutiny, particularly how providers store customer credentials and manage financial exposure from unauthorized usage. OpenCode’s difficulties using commercial AI models during its investigation also raise questions about their effectiveness in responding to cyberattacks.
- Breach Confined to OpenCode’s Hosted Console: Attackers accessed a legacy system associated with OpenCode Console, which allows teams to store API keys for shared access to AI models. The company notified the 1.4% of Console users affected on October 17. Co-founder Dax Raad confirmed that credentials stored locally through OpenCode’s desktop and command-line applications were unaffected.
- Developers Reported Unauthorized AI Charges: Users reported unexpected spending on their OpenAI, Anthropic, and Google accounts, with some claiming losses exceeding $1,000. Anthropic and Google reportedly blocked potentially exposed API keys, while OpenAI worked with OpenCode to restore access and refund unauthorized usage. OpenCode also confirmed that customer refunds were underway, although the total financial impact remains unknown.
- Suspected Model Distillation Connection Remains Unverified: OpenCode described the incident as related to a large-scale model distillation attack, which involves collecting outputs from existing AI systems to train other models. Compromised API keys could provide access to commercial AI services without attackers paying for the requests. However, the company has not explained how the intrusion was connected to distillation or identified those responsible.
- AI Safety Filters Complicated the Security Response: During the investigation, commercial AI models reportedly refused to analyze malicious code because their safety filters restricted certain requests. OpenCode later received access to OpenAI’s Daybreak Blue program, which provides vetted users with models better suited to authorized defensive security work. Raad said the access improved the team’s ability to investigate the attack.
- Attack Attempts Continued After the Breach: On October 18, Raad reported that attackers had been attempting to access OpenCode’s systems continuously for approximately 48 hours. The company said it was working with OpenAI, Anthropic, and Google to address the incident. Details about how attackers entered the legacy system, how long unauthorized access lasted, and the extent of credential exposure have yet to be released.
Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts – TechCrunch
