Hackers Drain AI Accounts via OpenCode Security Breach

The incident centers on OpenCode Console, a web-based interface where users manage API keys for third-party AI services. While the primary open-source coding tool remained secure, the breach allowed intruders to siphon keys and run up costs on connected accounts. Co-founder Dax Raad stated that the team faced a relentless 48-hour assault, struggling to analyze malicious code because the AI defensive agents they deployed repeatedly triggered their own safety filters.

This friction highlights a growing dilemma for security teams: the very guardrails designed to prevent AI misuse often block defenders from investigating active threats. The team eventually gained access to OpenAI’s Daybreak Blue program, which offers less restrictive models, allowing them to better track the intrusion. Similar issues were reported previously by Hugging Face, sparking debate among experts over whether current safety protocols inadvertently aid attackers by hindering rapid response. OpenCode has begun the process of issuing refunds, while affected users are being urged to revoke and replace their compromised keys immediately.