OpenCode Console breach exposes users' AI API keys to attackers

OpenCode, an open-source AI coding agent that has become a popular alternative to Claude Code and Cursor, disclosed on Saturday, 17 October 2026, that attackers had compromised an older system overnight. The intrusion affected 1.4% of users of OpenCode Console, the company's online platform where some customers keep the API keys they use to reach AI services.

In a post on X, OpenCode tied the incident to a large-scale distillation attack and said every affected user had been contacted by email; anyone who received no message was not impacted. The company did not explain how the distillation worked. Some skeptics questioned that framing, arguing the episode was an ordinary breach and that the keys' use for model distillation has not been demonstrated.

Surprise bills and refunds

Developers flooded Reddit and X overnight with spending alerts from OpenAI, Anthropic and Google accounts. Some described charges of several hundred dollars on a single account, and a few reported totals over $1,000. Anthropic and Google blocked keys they believed were exposed, while OpenAI said it worked with OpenCode to restore access and refund API credits consumed in the attack. OpenCode said refunds are in progress.

Co-founder Dax Raad said the exposure was limited to Console workspaces and did not touch the open-source app or command-line tool, whose keys never pass through the company. OpenCode has not disclosed how the older system was breached, how keys were stored or how far misuse went. It has asked affected users to revoke and replace keys with each provider and described the incident as ongoing.

Safety filters slowed the defense

Raad said attackers tried to break in continuously for 48 hours, forcing the team to run defensive AI agents around the clock. Models the team relied on for analysis eventually refused to help once the malicious code tripped their safety filters. OpenCode later gained access to OpenAI's Daybreak Blue program, which gives vetted users models less likely to refuse defensive security tasks, and Raad said that improved the investigation.

Hugging Face raised a similar complaint in July, saying commercial models blocked its analysis of an intrusion. David Sacks, co-chair of the President's Council of Advisors on Science and Technology, weighed in on X: "The guardrails backfired." The breach happened the same night OpenCode made GLM-5.3-Flash free to users.

The incident adds to a string of AI-enabled cyberattacks. Earlier in October, CrowdStrike said a China-based hacker likely used an AI penetration-testing agent and Claude against South Korean banks, and India's cybersecurity agency warned that AI agents had reached Indian organisations' systems without authorisation.