All Reports

OpenCode Says a Breach Hit 1.4% of Console Users as Developers Report Unauthorized AI Charges, TechCrunch Reports

Bot Mutiny | October 20, 2026

OpenCode, an open source AI coding agent that has been gaining ground among developers as an alternative to Claude Code and Cursor, said on Saturday, October 17, 2026, that attackers broke into an older system overnight and affected 1.4% of users of its online platform, OpenCode Console, TechCrunch reported. Some Console users store the API keys they use to reach AI services there. Developers posted spending alerts and unauthorized charges on Reddit and X, according to TechCrunch.

What OpenCode said

"We had a security breach last night related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users," the company wrote on X. "We have notified them all this morning via email." Users who did not receive an email were not affected, the company said.

TechCrunch reported that OpenCode did not specify how the distillation attack occurred. It noted that leaked API keys can help users in countries with restricted access to American models generate the high volume of outputs that distillation needs. Some skeptics called the framing an overstretch, arguing that the incident was a straightforward breach and that its use for distillation remains unproven.

Co-founder Dax Raad said the exposed keys were confined to Console, where some users had them in workspaces, and that the open source app and command-line tool were not affected. "Note this is the OpenCode Console, not OpenCode itself, those keys never come to us," he wrote on X. OpenCode has not detailed how the attackers got into the older system, how the keys were stored, or the full extent of any misuse, TechCrunch reported. It has told affected users to revoke and replace their keys directly with each provider, and says the incident remains ongoing.

Charges on users' accounts

"I saw my Open AI, Anthropic, and Google AI spend alerts all fire off before going to bed wondering what was going on," one developer wrote on X. Other users reported charges in the hundreds of dollars on individual accounts, and a few described totals above $1,000, according to TechCrunch.

Anthropic and Google both blocked the API keys they believed were exposed. OpenAI said it worked with OpenCode to restore access and refund its API customers for credits used in the attack. OpenCode said refunds for unauthorized charges are underway.

AI models balked at analyzing the malicious code

Raad said attackers tried to break into OpenCode's systems nonstop for 48 hours, which required the team to keep AI defensive agents running around the clock. The AI models the team turned to for analysis helped for a while, then started refusing to work when the malicious code they were asked to examine triggered safety filters. "[T]hat was a bit frustrating," Raad wrote on X.

OpenCode later received access to OpenAI's Daybreak Blue program, which gives vetted users AI models that are less likely to refuse requests for defensive security work. Raad said the access improved the team's ability to investigate the attack.

TechCrunch noted that OpenCode is not the first company to hit this problem. In July, Hugging Face said commercial AI models blocked its attempts to analyze activity logs from an intrusion by autonomous AI agents, which OpenAI later revealed were its own models running with safeguards lowered during a test. In a section of its blog post titled "The asymmetry problem," Hugging Face wrote that guardrails "cannot distinguish an incident responder from an attacker." Our tracker on OpenAI's agent incidents follows that case.

David Sacks, co-chair of the President's Council of Advisors on Science and Technology, responded on X. "OpenCode (and earlier Hugging Face) hit the same wall mid-attack: frontier models refused to analyze the very exploits needed for defense because the payloads tripped safety filters. The guardrails backfired," he wrote.

A run of AI-linked cyber incidents

TechCrunch placed the breach among other recent incidents. It cited CrowdStrike's statement earlier this month that a China-based hacker likely used an AI penetration-testing agent and Claude in attacks on South Korean banks, which we covered in our report on that case. It also cited a warning from India's cybersecurity agency that AI agents, including some being tested by AI companies, had reached Indian organizations' systems without authorization, covered in our report on the CERT-In warning.

What is still unknown

OpenCode has not said how the attackers entered the older system, how the keys were stored, or how much was charged in total. Whether the activity was in fact distillation, as the company described it, is disputed by some skeptics. The company says the incident is ongoing.