API Key Hijack: Attackers Infiltrate OpenCode Console to Drain Stolen AI Accounts

Hackers breached an older legacy system belonging to open-source coding tool OpenCode, compromising third-party credentials and running up massive unauthorized bills on user accounts. The security incident affected roughly 1.4 percent of OpenCode Console users who stored API keys for platforms like OpenAI, Anthropic, and Google inside their online workspaces. OpenCode notified impacted developers by email, warning them that unauthorized parties accessed saved credentials during a sustained 48-hour attack.

Developers woke up to unexpected spending alerts as attackers used stolen keys to query models continuously. Multiple users reported account charges ranging from hundreds to over $1,000 within hours. OpenCode described the breach as a model distillation attack, where threat actors use compromised API access to generate massive volumes of synthetic output and train competing open-weight models. However, security researchers noted that the company has not provided public technical proof linking the stolen keys directly to model distillation workflows.

In response to the sudden spike in unauthorized queries, Anthropic and Google revoked keys flagger for suspicious activity, while OpenAI worked directly with OpenCode to restore user access and issue refunds. OpenCode co-founder Dax Raad clarified that the breach remained isolated to the web-based OpenCode Console. The open-source desktop application and command-line interfaces were not affected, meaning local user environments stayed secure throughout the attack.

Defending against the ongoing intrusion proved unusually difficult for OpenCode’s technical team. The team deployed autonomous defensive AI agents to analyze incoming attack logs and isolate malicious payloads continuously over a 48-hour window. However, built-in safety filters inside the defensive models repeatedly blocked internal security analysis. When defensive agents reviewed malicious code samples to identify vulnerabilities, safety guardrails misclassified the security analysis as harmful activity and refused to process requests.

To bypass these safety locks, OpenCode secured access to OpenAI’s Daybreak Blue program. Daybreak Blue provides vetted cybersecurity teams with modified AI models that maintain lower refusal rates when analyzing dangerous payloads, exploit chains, and defensive telemetry. Accessing specialized security models allowed OpenCode engineers to finish their incident response work, block ongoing exploit attempts, and secure the remaining Console infrastructure.

The breach occurs alongside a broader rise in automated cyberattacks targeting developer platforms and enterprise infrastructure. Security firms like CrowdStrike recently reported an influx of autonomous agentic attacks probing corporate networks for unpatched flaws. Similar intrusions hit open-source platforms like Hugging Face earlier this year, showing how threat actors systematically target centralized credential stores to steal high-value computing access.

Centralizing API keys inside online developer consoles creates significant security risks for software teams. While storing third-party credentials in cloud workspaces makes cross-team collaboration easy, a single platform breach exposes multiple paid AI services at once. Developers using cloud workspace tools should rotate saved keys regularly, set strict monthly spending caps across provider accounts, and restrict credential access to prevent sudden financial losses during legacy system breaches.