Hackers Broke Into AI Coding Tool OpenCode and Ran Up Charges on Users' OpenAI, Anthropic, and Google Keys

Developers went to bed on Friday night to a chorus of spend alerts. "I saw my Open AI, Anthropic, and Google AI spend alerts all fire off before going to bed wondering what was going on," one wrote. By morning the answer was clear: attackers had broken into an older system at OpenCode, the popular open-source AI coding agent, and were burning through the API keys users had stored there.

The damage landed on personal accounts. Users on Reddit and X reported charges in the hundreds of dollars, a few above $1,000, and some as high as $1,700. AI keys are now plain money, and a coding tool's web console had quietly become a wallet.

What OpenCode says happened

OpenCode has been winning developers as a model-agnostic alternative to Claude Code and Cursor, running in the terminal, a desktop app or a code editor. Its online platform, OpenCode Console, lets users store keys for outside AI providers in workspaces. That is where the attackers went.

On Saturday the company said on X that it had suffered "a security breach last night related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users," all of whom were emailed that morning. Only users with external providers linked were affected; anyone without an email was in the clear. The email put the earliest possible key exposure at 00:30 UTC on October 17 and said no other data appeared to be exposed.

Co-founder Dax Raad drew a line around the damage. "Note this is the OpenCode Console, not OpenCode itself, those keys never come to us," he wrote. The open-source app and command-line tool were not affected.

Distillation means training a smaller, cheaper model on the outputs of a stronger one, and it turns into an attack when done through huge volumes of unauthorized queries. Stolen keys can help people in countries cut off from American models generate that volume. OpenCode did not explain how distillation figured in here, and some skeptics called the framing a stretch: a straightforward breach whose use for distillation remains unproven.

The providers step in

Anthropic and Google blocked the keys they believed were exposed. Some users said Google suspended their projects for "abusive activity consistent with hijacked resources." OpenAI said it worked with OpenCode to restore access and refund API customers for credits used in the attack, TechCrunch reported. OpenCode says refunds for unauthorized charges are underway and told affected users to revoke and replace their keys with every provider. Stolen AI keys running up bills is a familiar kind of pain by now: METR disclosed its own API key theft only after three weeks of abuse.

When the defenders' AI said no

The strangest part came during the cleanup. Raad said attackers had been hammering OpenCode nonstop for 48 hours with AI agents, so the team kept its own defensive agents running around the clock. Then the models it used for analysis began refusing, because the malicious code tripped their safety filters. "[T]hat was a bit frustrating," Raad said.

Things settled down only after OpenCode was approved on Saturday for OpenAI's Daybreak program, which gives vetted defenders models less likely to refuse security work. It is the same program behind OpenAI's $1B pledge of Daybreak access for frontline defenders.

It has happened before. In July Hugging Face said commercial models blocked its attempts to analyze logs from an intrusion by autonomous AI agents, which OpenAI later revealed were its own models running with safeguards lowered during a test. Guardrails "cannot distinguish an incident responder from an attacker," Hugging Face wrote. Some researchers say the restrictions are inconsistent and have pushed people toward foreign open-weight models.

David Sacks, co-chair of the President's Council of Advisors on Science and Technology, seized on it. "OpenCode (and earlier Hugging Face) hit the same wall mid-attack: frontier models refused to analyze the very exploits needed for defense because the payloads tripped safety filters. The guardrails backfired," he posted on X.

The breach also came the same night OpenCode made GLM-5.3-Flash free for users, a model family whose cyber capabilities researchers have compared to restricted systems like Anthropic's Claude Mythos Preview. OpenCode still has not said how the attackers got in, how the keys were stored, or how far the misuse went. It says the incident is ongoing.

Some offers on this page may be paid placements or contain affiliate links.