Over the weekend, attackers accessed an older OpenCode system and obtained API keys from 1.4% of OpenCode Console users, the company said. The keys—used for services including OpenAI, Anthropic and Google—were followed by spending alerts and unauthorized charges, in some cases reaching hundreds or more than $1,000. OpenCode said its open-source app and command-line tool were not affected.¹

The company described the incident as a large-scale distillation attack, though skeptics questioned whether that label went beyond what had been established. What is clearer is the immediate damage: providers moved to block exposed keys, OpenAI said it would restore access and refund affected API customers, and OpenCode began its own refund process.

The pressure did not end with the initial breach. Co-founder Dax Raad said attackers had been probing the company’s systems continuously for 48 hours, forcing the team to run defensive AI agents around the clock. But when investigators fed malicious code into frontier models, the tools that had initially helped began refusing requests after their safety filters were triggered. OpenCode subsequently gained access to OpenAI’s Daybreak Blue program for vetted cyber defenders, which offers models with fewer restrictions.²

That sequence revived a dispute already familiar from Hugging Face’s earlier intrusion response: can a model distinguish a legitimate incident responder from an attacker who makes an identical request? Security teams argue that, in a live breach, the distinction cannot be left to a blunt refusal mechanism. AI companies counter that their most capable cyber tools must be gated precisely because malicious actors would exploit them too.

David Sacks seized on OpenCode’s account as evidence against centralized safety controls, arguing that OpenCode and Hugging Face had both hit the same obstacle “mid-attack” because defensive analysis tripped the guardrails. “The guardrails backfired,” he wrote.David Sacks (DavidSacks)³

For OpenCode users, the immediate task is replacing keys. For the AI industry, the harder question is whether vetted access programs can move quickly enough before defenders are forced to choose between constrained proprietary systems and less-controlled open-weight alternatives.