AI Tool Cyberattack: OpenCode Users Hit With Unauthorized Charges!

OpenCode, an open source AI coding agent, recently announced a security breach affecting an older system overnight, impacting 1.4% of users on its online platform, OpenCode Console. This incident, described by the company as a "large-scale distillation attack," exposed API keys – digital passwords used to access various AI services – that some users stored in their workspaces within the Console. The company promptly notified affected users via email and assured that those who did not receive an email were not impacted.

The breach led to significant unauthorized charges on developer accounts for services from major AI providers like OpenAI, Anthropic, and Google AI. Developers took to platforms like Reddit and X to report unexpected spending alerts and charges, with some users detailing hundreds of dollars in individual account charges and a few even exceeding $1,000. This immediate financial impact underscored the severity of the compromised API keys.

In response to the escalating situation, Anthropic and Google swiftly blocked the API keys they believed to be exposed, aiming to mitigate further unauthorized access. OpenAI collaborated with OpenCode to restore access for affected users and processed refunds for credits used during the attack. OpenCode, for its part, confirmed that refunds for unauthorized charges are currently underway, acknowledging the financial burden placed on its users. Co-founder Dax Raad clarified that only the OpenCode Console was affected, not the core open source app or command-line tool, as keys for these typically do not reside on their systems.

While OpenCode framed the incident as a "distillation attack," which can involve using leaked API keys to generate a high volume of outputs for AI model training or refinement, some skeptics questioned this framing. They argued that it might have been a more straightforward breach, with the "distillation" aspect remaining unproven. Regardless of the precise nature, the ongoing pressure on the OpenCode team was evident, with attackers reportedly attempting to breach their systems non-stop for 48 hours, necessitating round-the-clock operation of AI defensive agents.

A critical challenge highlighted by this incident, and previously by others, is the "asymmetry problem" in defending against AI-driven cyberattacks. OpenCode's defensive AI agents, initially helpful in analyzing malicious code, eventually started refusing to work due to activating safety filters within the AI models they were using. This frustration, as expressed by Raad, echoes a similar experience reported by AI platform Hugging Face in July, where commercial AI models blocked attempts to analyze intrusion logs from autonomous AI agents due to guardrails.

To overcome this hurdle, OpenCode secured access to OpenAI’s Daybreak Blue program, which provides vetted users with AI models that are less prone to refusing requests for defensive security work. This access significantly enhanced their ability to investigate the attack. Security researchers and prominent figures like David Sacks, co-chair of the President’s Council of Advisors on Science and Technology, have voiced concerns about these guardrails, arguing they "backfired" by hindering legitimate security analysis and pushing some researchers towards less restricted, foreign open-weight models.

The breach coincidentally occurred on the same night OpenCode made GLM-5.3-Flash free, a model praised by researchers for its cybersecurity capabilities, approaching those of restricted-access models. However, OpenCode has yet to detail how attackers gained access to the older system, the specifics of key storage, or the full extent of any misuse. The company advises affected users to revoke and replace their API keys directly with each provider, confirming the incident remains ongoing. This event is part of a growing trend of AI-enabled cyber incidents, including reports of China-based hackers using AI penetration-testing agents and warnings from India’s cybersecurity agency about unauthorized AI agent access to organizational systems.