AI coding tool OpenCode hacked; developer accounts compromised—surprisingly by AI.

Recently, the open‑source AI programming tool OpenCode became embroiled in a security scandal.

Multiple developers have discovered abnormal charges on the accounts they use to call models such as OpenAI and Anthropic; some have reported losses of several hundred dollars, while others claim losses exceeding $1,700. Subsequently, OpenCode officially confirmed a hacker intrusion, affecting about 1.4% of OpenCode Console users, and some model API keys stored on the platform may have been leaked.

Surprisingly, OpenCode also mentioned in its statement that the incident is related to a “large‑scale distillation attack” and said it is working with the three model providers—OpenAI, Anthropic, and Google—to address the issue.

This claim quickly sparked discussion among developers and drew attention to the security of OpenCode’s cloud services.

Image | OpenCode confirms a security incident on social media (source: X)

From a flagship open-source project to key leakage

OpenCode is one of the open‑source AI programming tools that has attracted considerable attention from developers in recent years. Its backing Anomaly team has long been active in the open‑source development‑tool space, having launched projects such as SST and OpenNext. SST primarily helps developers build and deploy applications, and the team was selected for the renowned startup accelerator Y Combinator.

One of OpenCode’s main creators, Dax Raad, has also been involved in open‑source software development for a long time. In an interview he mentioned that the early experience of using large models to assist coding was far from smooth. Programmers had to leave their editor, open a browser to query the model, and then copy the generated code back into the development environment, constantly interrupting their workflow.

Therefore, OpenCode aims to bring AI directly into the development environment, allowing the model to do more than just answer questions—it can read project files, modify code, execute commands, and continuously complete tasks according to the developer’s instructions.

Unlike some AI coding tools that rely primarily on their own models, OpenCode also allows developers to freely integrate models from different vendors. This openness is a key attraction for users, and it also makes model integration and credential management issues that the product must address.

In addition to locally run programs, OpenCode offers a cloud service called Console. Teams can store API keys from model providers such as OpenAI, Anthropic, Google, etc., centrally in a workspace, and let Console invoke the models on their behalf. This way, team members can use the corresponding model services without needing to obtain the keys directly.

This security incident happened precisely in that cloud service.

According to the notification email sent by OpenCode to affected users, the attacker accessed an old system that is being decommissioned without authorization, potentially exposing some third‑party model API keys stored in the Console workspace. An API key serves as the credential for accessing model services. As long as the key remains valid, its holder can invoke the model as the original user, and any incurred costs will be charged to the original account.

In publicly shared feedback, developer Colin Parsons reported abnormal usage charges of $281 on his OpenAI account and $168 on his Anthropic account; another developer, Preston Zeller, said the loss amounted to about $1,700. Additionally, some users reported roughly $400 in unexpected Anthropic charges and Google services triggering account limits due to abnormal usage.

OpenCode subsequently notified affected users to revoke and replace their keys, and to check recent model call logs. Anthropic Claude Code team member Lydia Hallie also stated on social media that Anthropic has worked with OpenCode to address the incident and has revoked the Claude API keys deemed to be affected.

Image | Security notification email from OpenCode publicly shared by affected users (source: Reddit user)

OpenAI has also become involved in the follow‑up handling of this incident. Team member Tibo said on social media that OpenAI is working with OpenCode to help affected API users restore normal service and refund the credits that were abnormally consumed during the attack.

In response to external concerns, Dax Raad issued a clarification: the affected component is the OpenCode Console, not the locally run OpenCode program. Model keys configured directly in the local tool are not transmitted to the OpenCode servers, so this incident does not mean that all OpenCode users’ keys are at risk of leakage.

However, the information disclosed by OpenCode remains limited. The officials have not explained how the attacker accessed the legacy system, how many keys were actually obtained, or whether other potential risks remain.

Why does a distillation attack appear behind key leakage?

In addition to the possibility of user keys being leaked, the “large‑scale distillation attack” mentioned in OpenCode’s official statement has also sparked discussion among developers.

Model distillation itself is a common machine‑learning technique. Simply put, it uses a more capable model to generate training data, then trains another model with that data so the latter learns part of the former’s abilities. This approach can reduce training and deployment costs and is a typical method for developing lightweight models.

But if someone, without authorization, continuously calls commercial models using a large number of accounts, collects their responses, code generation results, and other data, and then uses that data to train other models, it could constitute the so‑called distillation attack described by model vendors.

This claim has sparked skepticism among some developers. Some argue that a system breach or user key leakage and an attacker using those keys to perform model distillation are two distinct stages. Even if the attacker’s ultimate goal is to gather training data for a model, we still need to explain how they obtain the user credentials and what operations those credentials are used for.

In related discussions, some developers argue that the term “distillation attack” tends to focus external attention on the attacker’s intent, overlooking the fact that the user’s key has been leaked; others hold a different view, suggesting that a distillation attack may merely describe the attacker’s goal rather than a specific intrusion method. OpenCode has already acknowledged a security incident, so this phrasing alone cannot be used to conclude that the officials are trying to evade responsibility.

Beyond how the incident is characterized, another group of developers is more concerned with the basis for judgment. Some want OpenCode or the relevant model providers to disclose more technical details, including the specific content of anomalous requests, invocation characteristics, and the criteria used to label them as a distillation attack. Because the publicly available anomalous billing and usage data can only indicate that the account may have experienced unauthorized usage, it does not directly prove that these requests were used to collect training data for the model.

However, some developers argue that, given the attack and investigation are still ongoing, it is understandable that the authorities have not yet disclosed the full technical details. Especially when the attackers are still attempting to breach the system, premature disclosure of partial information could also affect subsequent investigation and mitigation efforts.

Currently, OpenCode has not released a complete incident investigation report, and the identity of the attackers, the exact number of leaked keys, and the specific relationship between the distillation attack and system intrusion remain unclear.

AI agents are getting stronger, and security issues are becoming more complex

This OpenCode incident also drew attention to the security issues behind AI programming tools. In addition to the potential leakage of cloud credentials, the OpenCode team encountered limitations imposed by the AI model’s own safety mechanisms while responding to the attack.

On October 18, OpenCode co‑founder Dax Raad disclosed on social media that attackers had been attempting to breach OpenCode’s systems for the past 48 hours, and the team was continuously strengthening defenses. He also noted that his personal account had been targeted as well.

(Source: social media X)

However, the OpenCode team also encountered obstacles when using AI to assist investigations. Raad said that after the model performed extensive analysis, it refused to continue providing assistance because it triggered cybersecurity restrictions, and the situation only improved once the team obtained access to OpenAI Daybreak Blue. Daybreak Blue is a dedicated access mechanism that OpenAI provides for authorized cybersecurity defense work, designed to support more complex security research and incident response tasks.

Beyond AI’s use in cybersecurity investigations, the OpenCode incident also involves permission management of the AI programming tools themselves.

Unlike chatbots that primarily generate content based on user input, AI programming agents like OpenCode can directly read and modify project files, execute terminal commands, access the web, and connect to different models and external services. To perform these actions, they typically need to obtain model API keys, code repository permissions, and other access credentials in the development environment.

The affected OpenCode Console is designed to help developers centrally manage model calls. Teams can use multiple models uniformly through the cloud platform, reducing duplicate configuration and key transmission. At the same time, the platform also assumes responsibility for protecting these sensitive credentials. If the cloud service is compromised, the access permissions of various model accounts could be affected simultaneously.

In response to this incident, security firm StepSecurity, in an analysis article released after the event, recommends that developers using OpenCode Console check the associated model‑provider accounts, revoke any potentially compromised keys, and review recent call logs. For enterprise users, it is also necessary to confirm whether the same credentials have been used in other development environments to prevent the leakage risk from escalating further.

In addition to cloud credential management, the execution permissions of AI programming tools in local environments also deserve attention.

OpenCode’s official security policy on GitHub states that its Agent can execute terminal commands, manipulate files, and access the network, but it does not have a true sandbox isolation by default. In other words, even though some actions require user confirmation, this does not mean the Agent’s activities are strictly limited at the system level. For users who need isolation, the official recommendation is to run OpenCode inside a Docker container or a virtual machine.

Previously, developers have pointed out that even if the Agent is prohibited from directly modifying certain files, it can still indirectly alter them by executing authorized terminal commands. Therefore, some have suggested adding a dedicated sandbox to impose stricter restrictions on file and network access.

These issues have not been proven to be directly linked to the recent Console breach, but they do highlight two categories of security risks that AI programming tools must address: how to safeguard users’ API keys, and how to control the actual permissions of the Agent.

As AI agents become capable of completing more and more development tasks independently, developers, while enjoying the convenience, also need to pay closer attention to what data they can access and what actions they can perform. The OpenCode incident once again reminds us that the security of AI programming tools depends not only on the model itself but also on the cloud services and permission management mechanisms that support these functions.

Reference links:

https://x.com/opencode/status/2111519637049319818

https://www.reddit.com/r/opencode/comments/1x8bas3/they_fd_up_breach/

https://thehackernews.com/2026/10/opencode-console-breach-may-have.html

https://www.stepsecurity.io/blog/opencode-security-breach

https://vibeincidents.com/incidents/opencode-provider-key-exposure-2026-10/

https://opencode.ai/

https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks

https://www.anthropic.com/threat-intelligence-report-september-2026?page=1

https://www.anthropic.com/research/distillation-defenses

Operations/Formatting: He Chenlong

Note: Cover/featured image generated with AI assistance