OpenCode, an open-source AI coding agent that has been gaining floor amongst builders as an alternative choice to Claude Code and Cursor, stated Saturday that attackers broke into an older system in a single day, affecting 1.4% of customers of its on-line platform, OpenCode Console, the place some customers retailer the API keys, or digital passwords, they use to entry AI providers.
Because the OpenCode staff struggled to maintain tempo with the assault, the scramble to reply highlighted a rising drawback: corporations with out vetted entry to AI fashions with fewer security restrictions have a tough time defending in opposition to large-scale, AI-driven cyberattacks.
“We had a safety breach final night time associated to a large-scale distillation assault that impacted 1.4% of OpenCode Console customers,” the corporate wrote on X. “We’ve notified all of them this morning by way of e mail.” Customers who didn’t obtain an e mail weren’t impacted, the corporate stated.
Whereas the corporate didn’t specify how the distillation assault occurred, leaked API keys may help customers in international locations with restricted entry to American fashions generate the excessive quantity of outputs wanted for that course of. Some skeptics referred to as the framing an overstretch, arguing that the incident was an easy breach whose use for distillation stays unproven.
In a single day, builders started posting spending alerts and unauthorized fees on Reddit and X. “I noticed my Open AI, Anthropic, and Google AI spend alerts all hearth off earlier than going to mattress questioning what was happening,” a developer wrote.
Different customers reported fees within the tons of of {dollars} on particular person accounts; a number of described totals above $1,000.
Anthropic and Google each blocked the API keys they believed have been uncovered, whereas OpenAI stated it labored with OpenCode to revive entry and refund its API clients for credit used within the assault. OpenCode stated refunds for unauthorized fees are underway.
The uncovered keys have been confined to Console, the place some customers had them in workspaces. The open-source app and command-line instrument weren’t affected, in accordance with co-founder Dax Raad. “Word that is the OpenCode Console, not OpenCode itself, these keys by no means come to us,” he wrote on X.
At the same time as customers and AI corporations moved to disable the uncovered keys, the OpenCode staff was nonetheless underneath strain. Raad stated attackers had been attempting to interrupt into its techniques nonstop for 48 hours, requiring the staff to maintain AI defensive brokers working across the clock. AI fashions that the OpenCode staff turned to for evaluation helped for some time, however began refusing to work when the malicious code they have been requested to look at activated security filters.
“[T]hat was a bit irritating,” he wrote on X.
OpenCode later acquired entry to OpenAI’s Dawn Blue program, which provides vetted customers AI fashions which can be much less more likely to refuse requests for defensive safety work. Raad stated the entry improved the staff’s capability to research the assault.
OpenCode isn’t the primary firm to hit this wall. In July, AI platform Hugging Face stated industrial AI fashions blocked its makes an attempt to research exercise logs from an intrusion by autonomous AI brokers, which OpenAI later revealed have been its personal fashions working with safeguards lowered throughout a check. In a piece of its weblog put up titled “The asymmetry drawback,” Hugging Face wrote that guardrails “can not distinguish an incident responder from an attacker.”
Safety researchers have raised related complaints, saying the restrictions are inconsistent and have pushed some towards international open-weight fashions, which anybody can obtain and run.
The weekend episode drew a response from David Sacks, co-chair of the President’s Council of Advisors on Science and Expertise.
“OpenCode (and earlier Hugging Face) hit the identical wall mid-attack: frontier fashions refused to research the very exploits wanted for protection as a result of the payloads tripped security filters. The guardrails backfired,” he wrote on X.
The breach occurred the identical night time OpenCode made GLM-5.3-Flash free for customers. The broader GLM-5.3 household has drawn consideration from researchers who research open-weight fashions and word that its cybersecurity capabilities approached ranges beforehand related to restricted-access fashions like Anthropic’s Claude Mythos Preview.
OpenCode has not detailed how attackers gained entry to the older system, how keys have been saved, or the total extent of any misuse. It has informed affected customers to revoke and exchange their keys straight with every supplier. The corporate stated the incident stays ongoing.
The breach lands amid a run of AI-enabled cyber incidents. Earlier this month, cybersecurity agency CrowdStrike stated a China-based hacker seemingly used an AI penetration-testing agent, which probes laptop techniques for weaknesses, and Claude in assaults on South Korean banks. Final week, India’s cybersecurity company warned that AI brokers, together with some being examined by AI corporations, had reached Indian organizations’ techniques with out authorization.
Whenever you buy by hyperlinks in our articles, we could earn a small fee. This doesn’t have an effect on our editorial independence.
