Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts

OpenCode, an open-source AI coding cause that has been gaining crushed among developers arsenic an alternate to Claude Code and Cursor, said Saturday that attackers broke into an older strategy overnight, affecting 1.4% of users of its online platform, OpenCode Console, wherever immoderate users store the API keys, oregon integer passwords, they usage to entree AI services.

As the OpenCode squad struggled to support gait with the attack, the scramble to respond highlighted a increasing problem: companies without vetted entree to AI models with less information restrictions person a hard clip defending against large-scale, AI-driven cyberattacks.

“We had a information breach past nighttime related to a large-scale distillation onslaught that impacted 1.4% of OpenCode Console users,” the institution wrote connected X. “We person notified them each this greeting via email.” Users who did not person an email were not impacted, the institution said.

While the institution didn’t specify however the distillation onslaught occurred, leaked API keys tin assistance users successful countries with restricted entree to American models make the precocious measurement of outputs needed for that process. Some skeptics called the framing an overstretch, arguing that the incidental was a straightforward breach whose usage for distillation remains unproven.

Overnight, developers began posting spending alerts and unauthorized charges connected Reddit and X. “I saw my Open AI, Anthropic, and Google AI walk alerts each occurrence disconnected earlier going to furniture wondering what was going on,” a developer wrote. 

Other users reported charges successful the hundreds of dollars connected idiosyncratic accounts; a fewer described totals supra $1,000.

Anthropic and Google some blocked the API keys they believed were exposed, portion OpenAI said it worked with OpenCode to reconstruct entree and refund its API customers for credits utilized successful the attack. OpenCode said refunds for unauthorized charges are underway.

The exposed keys were confined to Console, wherever immoderate users had them successful workspaces. The open-source app and command-line instrumentality were not affected, according to co-founder Dax Raad. “Note this is the OpenCode Console, not OpenCode itself, those keys ne'er travel to us,” helium wrote connected X.

Even arsenic users and AI companies moved to disable the exposed keys, the OpenCode squad was inactive nether pressure. Raad said attackers had been trying to interruption into its systems nonstop for 48 hours, requiring the squad to support AI antiaircraft agents moving astir the clock. AI models that the OpenCode squad turned to for investigation helped for a while, but started refusing to enactment erstwhile the malicious codification they were asked to analyse activated information filters. 

“[T]hat was a spot frustrating,” helium wrote connected X.

OpenCode aboriginal received entree to OpenAI’s Daybreak Blue program, which gives vetted users AI models that are little apt to garbage requests for antiaircraft information work. Raad said the entree improved the team’s quality to analyse the attack.

OpenCode isn’t the archetypal institution to deed this wall. In July, AI level Hugging Face said commercialized AI models blocked its attempts to analyse enactment logs from an intrusion by autonomous AI agents, which OpenAI later revealed were its ain models moving with safeguards lowered during a test. In a conception of its blog station titled “The asymmetry problem,” Hugging Face wrote that guardrails “cannot separate an incidental responder from an attacker.” 

Security researchers person raised akin complaints, saying the restrictions are inconsistent and person pushed immoderate toward overseas open-weight models, which anyone tin download and run.

The play occurrence drew a effect from David Sacks, co-chair of the President’s Council of Advisors connected Science and Technology.

“OpenCode (and earlier Hugging Face) deed the aforesaid partition mid-attack: frontier models refused to analyse the precise exploits needed for defence due to the fact that the payloads tripped information filters. The guardrails backfired,” helium wrote connected X.

The breach occurred the aforesaid nighttime OpenCode made GLM-5.3-Flash escaped for users. The broader GLM-5.3 household has drawn attraction from researchers who survey open-weight models and enactment that its cybersecurity capabilities approached levels antecedently associated with restricted-access models similar Anthropic’s Claude Mythos Preview. 

OpenCode has not elaborate however attackers gained entree to the older system, however keys were stored, oregon the afloat grade of immoderate misuse. It has told affected users to revoke and regenerate their keys straight with each provider. The institution said the incidental remains ongoing.

The breach lands amid a tally of AI-enabled cyber incidents. Earlier this month, cybersecurity steadfast CrowdStrike said a China-based hacker apt utilized an AI penetration-testing agent, which probes machine systems for weaknesses, and Claude successful attacks connected South Korean banks. Last week, India’s cybersecurity bureau warned that AI agents, including immoderate being tested by AI companies, had reached Indian organizations’ systems without authorization.