Direct answer
Hackers broke into the AI coding tool OpenCode over the weekend and stole users’ API keys — then spent them. Attackers compromised 1.4% of users of OpenCode Console, the hosted service where some developers store the keys for their OpenAI, Anthropic and Google AI accounts. Victims woke up to spending alerts and charges in the hundreds of dollars, a few above $1,000. (Source: TechCrunch)
What happened
OpenCode, the open-source AI coding agent that’s become a popular alternative to Claude Code and Cursor, disclosed on Saturday that attackers had broken into one of its older systems overnight — hitting OpenCode Console, the hosted dashboard where some users keep their AI API keys.
The company called the incident a “large-scale distillation attack” that affected 1.4% of Console users, all of whom it says have been notified by email. Sceptics called the framing an overstretch — a fancy label on what looks like a straightforward breach, with the “distillation” use of the keys unproven. Either way, exposed keys were misused, and developers posted spending alerts on Reddit and X: charges in the hundreds of dollars on individual AI accounts, a few above $1,000.
The AI providers moved fast. Anthropic and Google blocked the exposed keys; OpenAI worked with OpenCode to restore access and refund credits, with refunds now underway.
Co-founder Dax Raad said attackers had been hammering OpenCode’s systems non-stop for 48 hours, and that the company’s own AI defensive agents’ models refused to help when the malicious code tripped their safety filters — a guardrail meant to stop attacks ended up hindering the defence. OpenCode has since been given access to OpenAI’s Daybreak Blue programme, the incident-response resource the company built for exactly these situations.
That asymmetry problem has a name. After a similar incident, Hugging Face described how the guardrails on commercial AI models “cannot distinguish an incident responder from an attacker” — so the models stonewalled the people trying to contain the breach. White House science adviser David Sacks put it more bluntly: “The guardrails backfired.”
The open-source app and command-line tool were unaffected — “those keys never come to us,” the company said — and users who were hit have been told to revoke and replace their keys.
What it means for UK small businesses
This is a cautionary tale about where your AI keys live:
Treat API keys like bank cards, not passwords. A leaked password gets you locked out; a leaked AI API key gets you billed. Set spend limits or caps on every key, issue separate keys per tool and per team member, and rotate them periodically — the same hygiene you’d apply to company credit cards.
Know where your keys live. Audit the third-party dashboards, browser extensions and tools where you’ve pasted API keys. Every place a key sits is an attack surface you don’t control. Read up on the AI security basics every growing firm should have.
Monitor spend like cash. If your AI bill is usage-based, turn on spending alerts. The OpenCode victims found out via alerts — that’s the system working. A key burning money should wake someone up, not sit quietly for a month.
Honest limits / what to watch
OpenCode hasn’t said how the attackers got in, how the keys were stored, or the full extent of the misuse — the incident is still ongoing. The “distillation attack” framing is the company’s own account, and independent confirmation of what the keys were used for is still thin.
But zoom out and there’s a broader point: firms selling AI agents to small businesses rarely talk about AI spend as a financial attack surface. Agents burn tokens to do their work — and a compromised agent, or a compromised key, burns money. The cheapest defence is unglamorous: caps, alerts, revocation, and knowing who holds your keys.
FAQs
What happened in the OpenCode hack?
On October 18, attackers broke into an older OpenCode system and compromised 1.4% of users of OpenCode Console, where some users store their AI API keys. The keys were used to rack up charges on users’ OpenAI, Anthropic and Google AI accounts.
What is OpenCode?
OpenCode is an open-source AI coding agent that has gained popularity among developers as an alternative to Claude Code and Cursor. Only the hosted OpenCode Console was affected — the open-source app and command-line tool were not.
How much did the hack cost affected users?
Developers reported charges in the hundreds of dollars on individual AI accounts, with a few describing totals above $1,000. OpenAI said it would refund API customers for credits used in the attack; Anthropic and Google blocked the exposed keys.
Was the attack a “distillation attack”?
OpenCode described it as a large-scale distillation attack, but some sceptics called that framing an overstretch, arguing it was a straightforward breach and that use of the keys for distillation is unproven. Either way, API keys were exposed and misused.
What should I do if I store API keys in a third-party tool?
Revoke and replace them immediately if told you’ve been affected. More generally: use spend limits on every API key, rotate keys regularly, never commit them to code, and check your usage dashboards for unusual spikes.
What is the “asymmetry problem” mentioned after the attack?
Hugging Face coined the term after a similar incident: the safety filters on commercial AI models “cannot distinguish an incident responder from an attacker”, so the models refused to help analyse the attack — guardrails meant for safety backfired during defence.
