OpenCode said attackers accessed a legacy system slated for decommissioning, potentially exposing third-party API keys stored in Console workspaces for roughly 1.4% of OpenCode Console users.

Affected users were emailed the morning of October 17 under the subject line "Action Required: Potential provider key breach," naming OpenAI, Anthropic and Google as the providers whose credentials may have been caught up. Users who did not receive an email were not impacted, the company said.

Co-founder Dax Raad stressed the scope: "Note this is the OpenCode Console, not OpenCode itself, those keys never come to us" — the open-source app and command-line tool were not affected.

The company has not disclosed how attackers gained access, how many keys were compromised, or how long the intrusion went undetected, and it says the incident remains ongoing.

The striking twist is the motive. OpenCode characterized the incident as a "large-scale distillation attack," in which stolen keys are used to fire a huge volume of queries and capture responses to train a cheaper mimic of the original model — rather than simply draining accounts for cash.

Some skeptics called that framing an overstretch, arguing the incident was a straightforward breach whose use for distillation remains unproven.

The disclosure also landed amid a broader wave of AI-enabled cyber incidents: TechCrunch reports that earlier this month CrowdStrike said a China-based hacker likely used an AI penetration-testing agent and Claude in attacks on South Korean banks, and last week India's cybersecurity agency warned that AI agents had reached Indian organizations' systems without authorization.

Overnight, developers posted spending alerts and unauthorized charges on Reddit and X. One developer wrote of watching their OpenAI, Anthropic and Google AI spend alerts "all fire off before going to bed wondering what was going on."

According to Startup Fortune, one user reported $281 in unexpected charges on their OpenAI key and $168 on their Anthropic key, another reported more than $700 in overnight charges, and a third put the total above $1,700.

Anthropic and Google blocked the API keys they believed were exposed, while OpenAI said it worked with OpenCode to restore access and refund its API customers; OpenCode said refunds for unauthorized charges are underway. No provider-verified total for the charges has been published.

The response exposed an asymmetry now drawing policy attention. Raad said attackers had tried to break into OpenCode's systems nonstop for 48 hours, forcing the team to run AI defensive agents around the clock.

The models OpenCode turned to for analysis helped at first, then refused to continue when the malicious code they were asked to examine triggered safety filters — "[T]hat was a bit frustrating," Raad wrote.

Relief came through OpenAI's Daybreak Blue program, which gives vetted users models less likely to refuse defensive-security requests.

The same wall hit Hugging Face in July, when commercial models blocked analysis of logs from an intrusion; Hugging Face wrote that guardrails "cannot distinguish an incident responder from an attacker."

David Sacks, co-chair of the President's Council of Advisors on Science and Technology, weighed in: "The guardrails backfired."

Startup Fortune notes the uncomfortable lesson for teams adopting agentic coding tools: a stolen password gets you into one account, but a stolen OpenAI or Anthropic API key works like an instant line of credit against someone else's wallet, usable from anywhere until someone notices the bill.

The breach also came through boring infrastructure — a legacy Console system holding live credentials longer than it should have — not from a flaw in the AI agent itself.

OpenCode Console's pitch is centralizing team keys in one workspace, but that centralization makes the vault a high-value single point of failure.

Both Anthropic and OpenAI support per-key spend limits, and scoped keys per tool would have capped the damage in minutes for a user who lost $1,700 overnight, Startup Fortune reports.

OpenCode has told affected users to revoke and replace their keys directly with each provider and to review recent usage and billing logs, since rotating a key stops future abuse but not usage already incurred.

The company has not detailed how attackers accessed the older system, how keys were stored, or the full extent of any misuse, and the investigation continues.

The incident also arrived on the same night OpenCode made GLM-5.3-Flash free for users; TechCrunch notes the broader GLM-5.3 family has drawn researcher attention because its cybersecurity capabilities approached levels previously associated with restricted-access models like Anthropic's Claude Mythos Preview.

Expect sharper scrutiny of credential storage in agentic developer tools — and of how frontier-model guardrails handle defensive security work.