According to CoinMeta, on October 18th, OpenCode disclosed that its cloud console had been compromised, affecting approximately 1.4% of its users, and the keys for third-party models API hosted by them may have been leaked. Co-founder Dax Raad stated that over the past 48 hours, attackers had continuously attempted to infiltrate the system, forcing the team to operate defense proxies around the clock to identify vulnerabilities and strengthen the system. However, when using AI to investigate the attacks, the advanced models initially helped in the process but later began to reject some requests, as analyzing the actual attack code could easily trigger security protections. A similar situation occurred previously with Hugging Face, where the security team faced frequent rejections when using Claude to analyze attack records, and eventually switched to Zhispu GLM-5.2. OpenCode alleviated the issue through OpenAI's Daybreak Blue, and the situation improved after obtaining the necessary permissions. This incident sparked criticism from AI, a policy figure in the United States, who argued that the uniform security restrictions set by model companies might constrain defenders, while attackers are able to obtain AI capabilities through other means.