OpenCode disclosed that attackers broke into an older system overnight, affecting 1.4% of users on its online platform, OpenCode Console, where some users store API keys to access AI services. Developers reported unauthorized spending alerts and charges ranging from hundreds to over one thousand dollars on their OpenAI, Anthropic, and Google AI accounts. Anthropic and Google blocked the exposed keys, while OpenAI worked with OpenCode to restore access and refund affected customers for the used credits.
During the incident, the OpenCode team struggled to investigate the breach because frontier AI models kept refusing to analyze malicious code that activated their safety filters. The team eventually received access to OpenAI's Daybreak Blue program, which provides vetted users with models that have fewer restrictions for defensive security work. This security challenge mirrors a similar issue faced by Hugging Face in July, highlighting the growing difficulty defenders encounter when AI safety guardrails block incident analysis.
This incident highlights how rigid safety guardrails on frontier AI models can hinder incident response during large-scale cyberattacks, complicating defense efforts for companies.