OpenCode co-founder Dax Raad clarified that the incident was limited to the company's hosted Console infrastructure. The open-source coding application, including its command-line and desktop versions, was not compromised, according to the company.
The distinction matters because OpenCode allows developers to connect different AI models to automate programming tasks, generate features, and troubleshoot software. While the standalone application stores locally configured credentials on users' devices, Console provides a hosted environment where teams can access AI services using credentials saved in their workspaces.
Those credentials can authorize requests to external AI models, meaning unauthorized access could allow attackers to consume computing resources billed directly to the account owner.
Several developers reported unexpected charges after the incident. One user said their OpenAI account accumulated $281 in unauthorized usage, alongside another $168 charged through Anthropic. Another reported approximately $1,700 in losses, while separate accounts described hundreds of dollars in unexpected Google and Anthropic charges.
Some users also reported that Google suspended their cloud projects after detecting activity associated with compromised resources. These accounts have not been independently established as a complete measure of the breach's financial impact, and OpenCode has not disclosed an overall loss figure.
The company described the incident as connected to a large-scale AI model distillation attack, although it has not publicly explained how the exposed credentials were involved.
Distillation is a technique in which outputs from a more capable AI model are used to train another model. While the method has legitimate applications, unauthorized campaigns can involve generating large volumes of responses from commercial AI systems without the provider's permission.
OpenCode has not presented evidence establishing that the attackers used the exposed credentials for model training. The reported unauthorized charges demonstrate potential misuse of API access, but do not independently confirm a distillation operation.
Raad said attackers had continued targeting OpenCode's infrastructure for at least 48 hours. The company has not identified those responsible or explained how they gained access to the older system.
The investigation also encountered difficulties involving the AI tools OpenCode was using to analyze malicious code. According to Raad, some models began rejecting security-related requests because their safety mechanisms flagged the material being examined.
OpenCode subsequently received approval to use OpenAI's Daybreak cybersecurity model for defensive investigations. Raad said the additional access helped stabilize the company's response.
Meanwhile, OpenCode has been coordinating with the affected AI providers to address compromised credentials and unauthorized spending. Anthropic and Google blocked keys believed to be exposed, while OpenAI worked with OpenCode on restoring access and reimbursing customers for credits consumed during the attack.
OpenCode has also indicated that refunds for unauthorized usage are being processed.
The company's notification advised affected users to replace their credentials directly through their AI providers. Simply removing a compromised key from OpenCode Console would not invalidate it, because the credential could still authorize requests until the issuing provider revokes it.
Developers whose credentials were stored in Console were also advised to examine their provider billing records and usage histories for suspicious activity. Any applications or scripts relying on revoked credentials would need to be updated with replacement keys.
OpenCode said users who did not receive its notification email were outside the identified affected group.
Several details remain unresolved, including how the attackers accessed the legacy infrastructure, how many credentials may have been obtained, and whether the incident involved additional unauthorized activity beyond the reported API usage.
The company has also not disclosed the total number of affected users represented by the 1.4% figure.
For developers using OpenCode's standalone application, the company maintains that locally stored credentials were not involved. The reported exposure was confined to accounts using the hosted Console service with external AI providers connected.
The incident highlights a specific risk associated with storing AI provider credentials in third-party development platforms: a compromise of the intermediary service can expose access to separate accounts, potentially generating charges and service disruptions even when those providers' own systems have not been breached.
This analysis is based on reporting from Superpower Daily & Bleeping Computer.
Image courtesy of The Hacker News.
This article was generated with AI assistance and reviewed for accuracy and quality.
