Analysis
OpenCode, an open-source AI coding agent that has become a popular alternative to Claude Code and Cursor, said attackers breached an older part of its system and accessed API keys stored by users of OpenCode Console, its hosted platform, according to TechCrunch. The company said the breach affected 1.4% of Console users and happened the same night it made its GLM-5.3-Flash model free to use.
Developers reported unauthorized spending alerts across OpenAI, Anthropic and Google AI accounts; some individual accounts were hit with charges in the hundreds of dollars, and a few topped $1,000. Co-founder Dax Raad said attackers had been trying to break in for 48 hours, and that AI models the team used to investigate refused to continue once the malicious code triggered safety filters -- OpenCode later got access to OpenAI's Daybreak Blue program, meant for vetted users doing defensive security work that models would otherwise decline.
What OpenCode hasn't explained
The company has not disclosed how attackers obtained the keys, how they were stored, or the full scope of misuse. It called the incident a "large-scale distillation attack," implying the goal was harvesting model outputs to train a rival model, but skeptics see that framing as unproven and the incident as a more conventional credential breach dressed up in AI language. Raad said the open-source app and command-line tool were unaffected, since exposed keys were confined to the Console product.
Anthropic and Google blocked the keys they believed were compromised, and OpenAI worked with OpenCode to restore access and refund credits used in the attack. OpenCode says refunds for other unauthorized charges are underway, and it has told affected users to revoke and replace their keys directly with each provider.
For a tool built on the premise that developers can trust it with API access to multiple AI providers, the breach is a reminder that convenience and credential exposure are the same tradeoff: the more providers a coding agent can reach on a user's behalf, the more valuable -- and more exposed -- those stored keys become if the agent's own infrastructure isn't hardened to match.