SafetyRisk, alignment & guardrails
Hackers breach OpenCode Console, use stored AI provider API keys to run up charges on user accounts
Attackers got into a legacy OpenCode Console system and used stored OpenAI, Anthropic and Google API keys for about 48 hours, leaving some users with overnight bills. Anthropic and Google blocked the keys. OpenCode's own analysis stalled until OpenAI granted it vetted defensive model access.
From the TechCrunch AI article of October 19, 2026 and cited sources: Only the hosted OpenCode Console was affected. [1] [4] [5]
SOURCES[1] Hackers hit AI coding tool OpenCode, running up charges on… techcrunch.com[4] PlayCISO playciso.com[5] OrcaRouter orcarouter.ai
AT Pulse research deskPublished · Updated · 4 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- Original source
- TechCrunch AI article, independent perspective
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- When
- October 19, 2026 article published
- Covered
- Oct 20 edition
- Evidence
- 10 sources across 9 sites
Reach: not measured yet
Only the hosted OpenCode Console was affected. It kept users' third-party provider keys on OpenCode's servers, and the breach came through a legacy system that was being shut down. The open-source app and CLI keep keys local and were not exposed. Victims' other keys went untouched, which points to OpenCode as the source. [1] [4] [5]
Attackers used AI agents to send queries with the stolen keys for about two days. Affected users described overnight charges from a few hundred dollars up to about $1,700. Neither those figures nor OpenCode's own estimate that 1.4% of Console users were affected has been independently verified, and the total number of affected users is not public. [1] [4] [5] [6]
While investigating, OpenCode found that frontier models stopped analyzing the malicious code once it triggered their safety filters. The analysis improved only after OpenAI approved the company for Daybreak Blue, its vetted program for defenders. Hugging Face hit the same problem in July and switched to an open-weight GLM model to analyze attack logs. [1] [7] [8] [9]
Gateways that store keys for several AI providers put all those credentials in one place, and deleting a key in OpenCode does not revoke it.
Read the full assessment
Teams should revoke keys at each provider, set spend caps, and arrange vetted defensive model access before an incident.
Executive brief
During a live attack, the OpenCode team found that the frontier AI models it used for analysis stopped helping once the malicious code tripped their safety filters. Analysis improved only after OpenAI granted vetted Daybreak Blue access, per TechCrunch. The breach itself hit a legacy OpenCode Console system and exposed stored OpenAI, Anthropic and Google API keys for 1.4% of Console users. Users then reported overnight charges from hundreds of dollars up to about $1,700. Critics say nothing has shown the keys were used for distillation.
Read the full section
During a live attack, the OpenCode team found that the frontier AI models it used for analysis stopped helping once the malicious code tripped their safety filters. Analysis improved only after OpenAI granted vetted Daybreak Blue access, per TechCrunch. The breach itself hit a legacy OpenCode Console system and exposed stored OpenAI, Anthropic and Google API keys for 1.4% of Console users. Users then reported overnight charges from hundreds of dollars up to about $1,700. OpenCode calls it a "distillation attack." Critics say nothing has shown the keys were used for distillation.
What changed and event timeline
OpenAI tiers Daybreak
Daybreak Blue (GPT-5.6 Sol with adjusted safeguards) and Daybreak Red (including GPT-5.6-Cyber) open to vetted defenders ().
Legacy-auth hardening stalls
A contributor opened PR #45919 to add Cloudflare Turnstile to legacy console authentication. A bot auto-closed it about a month later for age and low engagement,.
Keys exposed, users notified
Dates the earliest exposure to 00:30 UTC. OpenCode emailed affected users and posted on X. The same night it made GLM-5.3-Flash free ().
Providers revoke keys; Daybreak access granted
Anthropic and Google blocked exposed keys, OpenAI promised refunds, and OpenCode received Daybreak Blue access (). Google suspended some projects for abuse ().
Capabilities and access
- What was affected: only OpenCode Console, the hosted platform where users saved provider keys in workspaces.
- Defensive model: Daybreak Blue runs GPT-5.6 Sol. It requires identity verification and monitoring, and hardware security keys from Sept 1, 2026 (National CIO Review).
- Model in the background: GLM-5.3-Flash went free on OpenCode the night of the breach.
Read the full section
- What was affected: only OpenCode Console, the hosted platform where users saved provider keys in workspaces. Co-founder Dax Raad says the open-source app and CLI never send keys to OpenCode (TechCrunch).
- Defensive model: Daybreak Blue runs GPT-5.6 Sol. It requires identity verification and monitoring, and hardware security keys from Sept 1, 2026 (National CIO Review).
- Model in the background: GLM-5.3-Flash went free on OpenCode the night of the breach. Researchers say the wider GLM-5.3 family approaches the cyber capability of restricted-access models (TechCrunch).
Technical analysis for researchers and developers
- Architecture: Console stores third-party keys on OpenCode's servers across 75+ supported providers. That concentrates credentials for several AI labs in one place (OrcaRouter).
- Entry point: a legacy system that was being shut down.
- Attack pattern: attackers used AI agents to send queries with the stolen keys for about 48 hours (BleepingComputer).
Read the full section
- Architecture: Console stores third-party keys on OpenCode's servers across 75+ supported providers. That concentrates credentials for several AI labs in one place (OrcaRouter).
- Entry point: a legacy system that was being shut down. OpenCode has not disclosed how attackers got in, how keys were stored or how long attackers had access.
- Attack pattern: attackers used AI agents to send queries with the stolen keys for about 48 hours (BleepingComputer).
- Forensic signal: victims' other keys went untouched, which points to OpenCode as the source (PlayCISO).
- Fix: revoke keys at each provider; deleting them in OpenCode alone does not invalidate them.
Claims and evidence
- 1.4% of Console users affected, all notified by email: this is OpenCode's own statement (TechCrunch). The absolute number of users is not public (OrcaRouter).
- "Distillation attack": another OpenCode label, with no evidence published. Skeptics call it an ordinary breach (TechCrunch).
- Charges of $281 + $168, $700+ and $1,700: these figures come from named users (OrcaRouter). PlayCISO says no one has independently verified them (PlayCISO).
Read the full section
- 1.4% of Console users affected, all notified by email: this is OpenCode's own statement (TechCrunch). The absolute number of users is not public (OrcaRouter).
- "Distillation attack": another OpenCode label, with no evidence published. Skeptics call it an ordinary breach (TechCrunch).
- Charges of $281 + $168, $700+ and $1,700: these figures come from named users (OrcaRouter). PlayCISO says no one has independently verified them (PlayCISO).
- Auto-closed Turnstile PR: reported only by PlayCISO; no other reviewed source corroborates it.
Context and prior work
- Earlier guardrail failure: Hugging Face's July post on "the asymmetry problem" argued that guardrails cannot tell an incident responder from an attacker (Zenity).
- Other AI-enabled attacks: CrowdStrike linked a China-based actor using an AI pentesting agent and Claude to attacks on South Korean banks.
- Response to vendor gating: OpenAI's tiered Daybreak program is its answer to defenders' complaints about refusals (TechRadar).
Read the full section
- Earlier guardrail failure: Hugging Face's July post on "the asymmetry problem" argued that guardrails cannot tell an incident responder from an attacker (Zenity).
- Other AI-enabled attacks: CrowdStrike linked a China-based actor using an AI pentesting agent and Claude to attacks on South Korean banks. India's cybersecurity agency warned of unauthorized AI-agent activity (TechCrunch).
- Response to vendor gating: OpenAI's tiered Daybreak program is its answer to defenders' complaints about refusals (TechRadar).
Limitations, safety and contested findings
- TechCrunch says OpenCode disclosed on Saturday (Oct 17). BleepingComputer gives the announcement as Oct 19.
- Distillation motive is unproven. OpenCode has not confirmed the distillation claim.
- The policy reading is disputed. David Sacks said the "guardrails backfired."
Read the full section
- Dates conflict. TechCrunch says OpenCode disclosed on Saturday (Oct 17). BleepingComputer gives the announcement as Oct 19. A secondary write-up places the intrusion on the night of Oct 16 (Reddit).
- Distillation motive is unproven. OpenCode has not confirmed the distillation claim.
- The policy reading is disputed. David Sacks said the "guardrails backfired." That is one interpretation; another is that vetted-access programs like Daybreak worked as intended once OpenCode was approved (TechCrunch).
- Refunds are not settled. OpenCode says refunds for unauthorized charges are underway. OrcaRouter reports reimbursement was unconfirmed as of Oct 19.
Business and practitioner implications
- Treat API keys like uncapped payment cards.
- Audit hosted gateways and retiring systems. Legacy systems are a real attack surface. Exempt security PRs from automated cleanup bots.
- Arrange defensive AI access before an incident. Getting vetted access mid-attack costs hours.
Read the full section
- Treat API keys like uncapped payment cards. Put hard spend caps and rate limits on new keys, and check billing back to Oct 17 (PlayCISO).
- Audit hosted gateways and retiring systems. Legacy systems are a real attack surface. Exempt security PRs from automated cleanup bots.
- Arrange defensive AI access before an incident. Getting vetted access mid-attack costs hours. Teams without it may turn to open-weight models, as Hugging Face did.
- Run local keys where possible. The CLI's local key model avoided this exposure entirely.
The source trail.
Sources (10)
Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts
Article text retrieved; extracted text may omit tables or interactive elements.
techcrunch.comThe OpenCode Hack Proves Your AI Keys Are the New Target
Related coverage; assess separately
reddit.comOpenCode’s AI Hack Changes Everything
Related coverage; assess separately
reddit.com