OpenCode hackers run up charges on users’ AI accounts

OpenCode hackers run up charges on users’ AI accounts

Hackers who breached an older OpenCode system left users reporting unauthorized AI charges in the hundreds of dollars, with a few describing totals above $1,000. The company said the attack affected 1.4% of users of OpenCode Console, its online platform where some users store API keys for accessing AI services.

AI providers moved to block exposed keys and address unauthorized spending, while OpenCode urged affected users to revoke and replace their keys directly with each provider. The company said refunds are underway and that the incident remains ongoing.

"We had a security breach last night related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users", the company wrote on X on Saturday. "We have notified them all this morning via email."

OpenCode said users who did not receive an email were not affected.

Spending alerts expose unauthorized use

Developers began sharing spending alerts and unexpected charges on Reddit and X overnight.

"I saw my Open AI, Anthropic, and Google AI spend alerts all fire off before going to bed wondering what was going on", a developer wrote.

Anthropic and Google blocked API keys they believed had been exposed. OpenAI said it worked with OpenCode to restore access and refund its API customers for credits used during the attack.

The breach was limited to Console, where some users kept keys in workspaces. OpenCode’s open source app and command-line tool were not affected, according to co-founder Dax Raad.

"Note this is the OpenCode Console, not OpenCode itself, those keys never come to us", he wrote on X.

OpenCode, an open source AI coding agent, has been gaining ground among developers as an alternative to Claude Code and Cursor. The company has not explained how attackers entered the older system, how the keys were stored or the full extent of their misuse.

It also has not detailed how the alleged distillation attack occurred. Leaked API keys can allow users in countries with restricted access to American models to generate the large volume of outputs needed for distillation. But some skeptics challenged OpenCode’s characterization, arguing that the incident was a straightforward breach and that use of the keys for distillation remains unproven.

sbb-itb-622dc24

Defensive AI tools hit safety limits

As users and providers worked to disable the exposed keys, OpenCode faced continuing attempts to breach its systems. Raad said attackers had been trying nonstop for 48 hours, forcing the team to keep AI defensive agents running around the clock.

The AI models the team used to investigate initially helped, he said, but later refused requests when malicious code submitted for analysis triggered safety filters.

"[T]hat was a bit frustrating", he wrote on X.

OpenCode subsequently received access to OpenAI’s Daybreak Blue program, which provides vetted users with AI models less likely to refuse requests for defensive security work. Raad said that access improved the team’s ability to investigate.

The episode highlighted a problem previously reported by Hugging Face. In July, the AI platform said commercial models blocked its attempts to analyze logs from an intrusion by autonomous AI agents. OpenAI later disclosed that those agents were its own models operating with lowered safeguards during a test.

In a section of its blog post titled "The asymmetry problem", Hugging Face wrote that guardrails "cannot distinguish an incident responder from an attacker."

Security researchers have also complained that inconsistent restrictions impede their work, pushing some toward foreign open-weight models that anyone can download and run.

David Sacks, co-chair of the President’s Council of Advisors on Science and Technology, weighed in on the OpenCode incident.

"OpenCode (and earlier Hugging Face) hit the same wall mid-attack: frontier models refused to analyze the very exploits needed for defense because the payloads tripped safety filters. The guardrails backfired", he wrote on X.

A broader run of AI-enabled incidents

The OpenCode breach comes amid other reports of AI-enabled cyber activity. Earlier this month, cybersecurity firm CrowdStrike said a China-based hacker likely used an AI penetration-testing agent and Claude in attacks on South Korean banks.

Last week, India’s cybersecurity agency warned that AI agents, including some being tested by AI companies, had accessed Indian organizations’ systems without authorization.

For OpenCode users, key details remain unresolved: The company has not disclosed how the older system was compromised or the full scope of unauthorized activity, even as refunds and efforts to contain the incident continue.

Read the source