Open-source AI programming proxies OpenCode have recently become popular among developers and are seen as alternatives to Claude Code and Cursor. The company stated on Saturday that attackers infiltrated its older systems overnight, affecting 1.4% of users on its online platform OpenCode Console. Some users store their API keys, which are digital passwords, on this platform for accessing AI services.
While the OpenCode team is working hard to counter the attacks, this emergency response has also highlighted an increasingly serious issue: companies that use AI models, which lack review and have fewer access restrictions, find it very difficult to defend against large-scale cyberattacks driven by AI.
OpenCode wrote on X: 'Last night, we encountered a security vulnerability related to a large-scale distillation attack that affected 1.4% of OpenCode Console's users. We have notified all affected users by email this morning.' The company stated that users who did not receive the email were not affected.
The company did not explain how this distillation attack occurred. However, the leaked API key may help users in countries with restricted model access in the United States generate the large amount of output required for that process. Some skeptics believe that this claim is somewhat exaggerated, stating that the incident was just a regular intrusion, and whether it was used for distillation has not yet been confirmed.
On the night of the incident, developers began to post expenditure reminders and unauthorized fee deductions on Reddit and X. One developer wrote, "Before going to bed, I saw that my OpenAI, Anthropic, and Google AI expenditure reminders all went off. I have no idea what happened."
Other users reported that a single account had been charged several hundred dollars; a few said the total amount exceeded 1,000 dollars.
Anthropic and Google have both blocked what they consider to be the leaked API keys, while OpenAI indicates that they have cooperated with OpenCode to restore access and have refunded to their API customers the points that were used in this attack. OpenCode states that refunds for unauthorized charges are currently in progress.
The exposed keys are limited to Console; some users stored them in their workspaces. Co-founder Dax Raad stated that the open-source applications and command-line tools were not affected. He wrote on X: "Note, this is OpenCode Console, not OpenCode itself; those keys never reached us at all."
Even though both users and AI are trying to deactivate these exposed keys, the OpenCode team is still under pressure. Raad stated that attackers have been continuously attempting to invade their system for 48 hours, forcing the team to operate the AI defense agents around the clock. The AI models used by the OpenCode team helped at first, but they began to fail after triggering the security filters due to the malicious code being checked.
He wrote on X, "This is a bit disheartening."
Subsequently, OpenCode obtained access to the Daybreak Blue plan of OpenAI. This plan provides users who have gone through review with a AI model that is less likely to reject defensive security work requests. Raad stated that this permission has enhanced the team's ability to investigate this attack.
OpenCode is not the first company to encounter this problem. In July, the AI platform stated that its AI model prevented it from analyzing an intrusion activity log initiated by autonomous AI agents; it was later revealed that these agents were actually its own models, with security restrictions being lowered during testing. Hugging Face wrote in a blog post titled "Asymmetric Problem" that the protection mechanism "cannot distinguish between event responders and attackers."
Security researchers have also raised similar complaints, stating that these restrictions are inconsistent, and have prompted some to turn to foreign open-source weight models, as anyone can download and run these models.
Events this weekend also drew a response from David Sacks, co-chair of the U.S. President's Science and Technology Advisory Committee.
He wrote on X: “OpenCode (as well as the earlier Hugging Face) encountered the same problem halfway through the attack: the cutting-edge models refused to analyze the vulnerability exploits required for defense, because the payload triggered the security filters. The countermeasures had the opposite effect.”
The intrusion occurred on the same night that OpenCode will make GLM-5.3-Flash available to users for free. The broader GLM-5.3 series has attracted the attention of researchers studying open-source weight models, who have pointed out that the cybersecurity capabilities of this series have approached the levels previously associated with restricted-access models, such as those of Claude Mythos Preview in Anthropic.
OpenCode There has not been a detailed explanation of how the attackers managed to gain access to the old system, how the keys were stored, or the full extent of any misuse. The company has requested that affected users directly cancel and replace their keys with their respective service providers. The company stated that this incident is still ongoing.
At the time of this intrusion, there has been an increase in cyber incidents empowered by AI. Earlier this month, cybersecurity company CrowdStrike indicated that a hacker suspected to be from China may have used AI penetration testing proxies and Claude in attacks on Korean banks. Last week, Indian cybersecurity agencies warned that AI proxies, including some that were being tested by AI companies, had entered the systems of Indian organizations without authorization.
