OpenCode Console Breach Affects 1.4% of Users
OpenCode, an open-source AI coding agent gaining traction among developers as an alternative to Claude Code and Cursor, disclosed on Saturday that attackers had breached an older system overnight. The incident affected 1.4% of users on its online platform, OpenCode Console, where some users store the API keys—digital passwords used to access AI services.
Distillation Attack or Straightforward Breach?
As the OpenCode team scrambled to respond, the incident underscored a growing challenge in 2026: companies without vetted access to AI models with fewer safety restrictions struggle to defend against large-scale, AI-driven cyberattacks.
"We had a security breach last night related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users," the company wrote on X. "We have notified them all this morning via email." Users who did not receive an email were not impacted, according to the company.
While OpenCode did not specify how the distillation attack occurred, leaked API keys could enable users in countries with restricted access to American models to generate the high volume of outputs required for such a process. Some skeptics called the framing an overstretch, arguing the incident was a straightforward breach whose use for distillation remains unproven.
Users Report Hundreds to Over $1,000 in Unauthorized Charges
Overnight, developers began posting spending alerts and unauthorized charges on Reddit and X. "I saw my OpenAI, Anthropic, and Google AI spend alerts all fire off before going to bed wondering what was going on," one developer wrote.
Other users reported charges in the hundreds of dollars on individual accounts; a few described totals exceeding $1,000.
Anthropic and Google both blocked the API keys they believed were exposed, while OpenAI said it worked with OpenCode to restore access and refund its API customers for credits used in the attack. OpenCode said refunds for unauthorized charges are underway.
Exposure Confined to Console, Not the OpenCode App
The exposed keys were confined to Console, where some users had stored them in workspaces. The open-source app and command-line tool were not affected, according to co-founder Dax Raad. "Note this is the OpenCode Console, not OpenCode itself; those keys never come to us," he wrote on X.
Defensive AI Agents Hit Safety Filters
Even as users and AI companies moved to disable the exposed keys, the OpenCode team remained under pressure. Raad said attackers had been trying to break into its systems nonstop for 48 hours, requiring the team to keep AI defensive agents running around the clock. AI models the team turned to for analysis helped for a while, but began refusing to work when the malicious code they were asked to examine activated safety filters.
"[T]hat was a bit frustrating," he wrote on X.
OpenCode later received access to OpenAI's Daybreak Blue program, which gives vetted users AI models less likely to refuse requests for defensive security work. Raad said the access improved the team's ability to investigate the attack.
OpenCode isn't the first company to face this... [content truncated]
via TechCrunch AI