By Hamza Faisal

The fallout from OpenCode's weekend security breach keeps spreading. Developers woke up to find someone else burning through their AI budgets — as unauthorized charges piled up on the API keys stolen in the attack on the open-source coding tool's online Console.

Overnight, developers began posting spending alerts and unauthorized charges on Reddit and X. One wrote that he watched his OpenAI, Anthropic, and Google AI spend alerts "all fire off before going to bed wondering what was going on." Other users reported charges in the hundreds of dollars on individual accounts, with some describing totals above $1,000.

Spend alerts fire overnight

OpenCode, an open-source AI coding agent gaining ground among developers as an alternative to Claude Code and Cursor, disclosed on Saturday that attackers broke into an older system overnight, affecting 1.4% of users of OpenCode Console — the online platform where some customers store the API keys, or digital passwords, they use to access AI services. The company said it notified all affected users by email that morning; anyone who did not receive an email was not impacted.

OpenCode described the incident as a "large-scale distillation attack," a framing some skeptics called an overstretch, arguing the breach was clear but its use for training-data distillation was unproven. Leaked keys could let people in countries with restricted access to American models generate the high volume of outputs that distillation requires.

Providers block the leaked keys

The AI providers moved quickly. Anthropic and Google both blocked the API keys they believed had been exposed, while OpenAI said it worked with OpenCode to restore access and refund its API customers for credits used in the attack. OpenCode said refunds for unauthorized charges are underway.

Crucially, the exposed keys were confined to Console workspaces. The open-source app and command-line tool were not affected, co-founder Dax Raad said: "Note this is the OpenCode Console, not OpenCode itself, those keys never come to us."

OpenCode has told affected users to revoke and replace their keys directly with each provider. The company says the incident remains ongoing.

The guardrails that backfired

The scramble to respond exposed a deeper problem: the defenders could not fully use AI to defend themselves. Raad said attackers had been trying to break into OpenCode's systems nonstop for 48 hours, forcing the team to run AI defensive agents around the clock. The models the team turned to for analysis helped at first — then started refusing to work when the malicious code they were asked to examine tripped safety filters. "That was a bit frustrating," Raad wrote on X.

OpenCode later received access to OpenAI's Daybreak Blue program, which gives vetted users AI models less likely to refuse requests for defensive security work. Raad said the access improved the team's ability to investigate.

It is not the first time. In July, Hugging Face said commercial AI models blocked its attempts to analyze activity logs from an intrusion by autonomous AI agents, which OpenAI later revealed were its own models running with safeguards lowered during a test. In a blog section titled "The asymmetry problem," Hugging Face wrote that guardrails "cannot distinguish an incident responder from an attacker."

The weekend episode drew a response from David Sacks, co-chair of the President's Council of Advisors on Science and Technology: "OpenCode (and earlier Hugging Face) hit the same wall mid-attack: frontier models refused to analyze the very exploits needed for defense because the payloads tripped safety filters. The guardrails backfired."

The breach occurred the same night OpenCode made GLM-5.3-Flash free for users. The broader GLM-5.3 family has drawn attention from researchers who note its cybersecurity capabilities approached levels previously associated with restricted-access models like Anthropic's Claude Mythos Preview.

By Hamza Faisal