A stolen password can open a door. A stolen AI access key can do something less obvious: let someone else run up a bill while using powerful models under your account. That was the problem facing some users of OpenCode after attackers broke into an older system connected to its online platform.
But the breach exposed a second vulnerability, harder to patch with a password reset. As OpenCode tried to investigate, AI tools it used for security analysis began refusing to examine suspicious code. The software that can help explain an attack may also mistake the defender for the attacker.
One platform, two different kinds of access
OpenCode is an open-source AI coding agent, an application that can use AI models to help developers write and work with code. The incident affected OpenCode Console, an online service where some users kept the API keys that connect to AI providers. Those keys act like digital credentials: whoever has one may be able to make requests billed to its owner.
OpenCode said attackers accessed an older system and affected 1.4% of Console users. Developers reported unexpected spending alerts and unauthorized charges, in some cases reaching hundreds of dollars and, according to a few users, more than $1,000. OpenCode said refunds were underway; OpenAI worked with the company to restore access and refund affected API customers, while Anthropic and Google blocked keys they believed had been exposed.
The company stressed that the breach did not affect the open-source app or command-line tool itself. The exposed keys were associated with Console workspaces, and OpenCode’s co-founder said the keys did not pass through the app. Affected users were told to revoke and replace their credentials with the providers.
Was the goal to copy an AI’s skills?
OpenCode described the breach as connected to a large-scale distillation attack. In AI development, distillation generally means using one model’s outputs to help train or improve another. A stream of answers from a powerful model can, in principle, provide material for building a smaller or otherwise different system that imitates some of its capabilities.
Stolen API keys could make that kind of activity cheaper or easier to conceal by letting someone send requests through other people’s accounts. But OpenCode has not explained exactly how the attackers entered the older system or demonstrated how the exposed keys were used. Some observers questioned whether the evidence justified calling the incident a distillation attack. The breach is established; the alleged purpose remains less clear.
That distinction matters. An unauthorized user running up charges is already a serious security incident. Connecting it to model training suggests a broader contest over who can access advanced AI capabilities, but that interpretation needs evidence about what the attackers actually did—not just the possibility of what stolen keys could enable.
When safety filters obstruct the investigation
OpenCode’s more immediate challenge was determining what had happened and stopping further access. Co-founder Dax Raad said attackers had been targeting the company’s systems continuously for 48 hours. AI agents helped the team examine the incident, but some models began declining requests when the code under investigation triggered their safety protections.
That is a difficult boundary for AI companies to draw. A request to analyze malicious code can come from a criminal seeking to improve it—or from an incident responder trying to identify and contain it. A filter that blocks dangerous material may prevent misuse, yet the same filter can also withhold help at the moment defenders need it most.
OpenCode later gained access to OpenAI’s Daybreak Blue program, which provides vetted users with models less likely to refuse defensive security work. Raad said this improved the investigation. A similar tension surfaced in a previous incident involving Hugging Face, which said commercial models blocked analysis of activity linked to autonomous AI agents. Security researchers have also warned that inconsistent restrictions can push users toward open-weight models, which can be downloaded and run outside a provider’s service.
The new shape of the security problem
The OpenCode incident comes amid growing concern about AI agents being used in cyberattacks. A model can help automate tasks such as probing systems for weaknesses, while an agent can string together steps with less human intervention. That does not make every attack an AI attack, and the details of this breach remain incomplete. It does mean that defenders may increasingly face threats that move quickly—and need tools that can help them respond just as quickly.
There is a paradox at the center of that race: access to powerful AI can create new security risks, but denying defenders access to useful analysis can leave them slower and less informed. The challenge is not simply to make models say yes or no to dangerous-looking code. It is to help them recognize the difference between someone trying to break in and someone trying to understand how the break-in happened. For a defender staring at a stolen key, that distinction can be the difference between an AI assistant and another locked door.