OpenCode breach exposes API keys as AI guardrails stall the defenders
Attackers used stolen OpenAI, Anthropic, and Google API keys. Meanwhile, the most advanced AI models reportedly refused to help security teams study the code used in the attack.
Photo: Mikhail Nilov / Pexels
Anomaly Innovations, the company behind OpenCode, an open-source AI coding tool, reported a security breach on October 17, 2026. Attackers broke into an old system connected to its Console product and stole API keys belonging to some users. These keys let users connect to AI services from other companies.
The cleanup brought an unusual problem. The AI models that security teams wanted to use to study the attack code reportedly refused to help.
What happened inside OpenCode’s Console
According to the research findings, about 1.4% of OpenCode Console users had their API keys exposed. These keys gave access to outside AI providers, including OpenAI, Anthropic, and Google.
The attackers used the stolen keys to carry out large amounts of activity, including model distillation. The costs of this activity were charged to the real users who owned the keys.
Model distillation means sending a powerful AI model a huge number of questions and using its answers to train a cheaper model that tries to copy it.
Some users reportedly faced unauthorized charges of hundreds of dollars, while others were charged more than $1,000.
Affected users were notified by email. The hacked system was an older system that was already being taken out of service. It was still running when the attackers found a way into it.
The providers acted, but the models refused to help
The AI companies whose keys were exposed took steps to limit the damage. Anthropic and Google canceled the stolen keys so they could no longer be used.
OpenAI took another step. It worked with OpenCode to refund credits linked to charges caused by the breach.
OpenCode also faced delays while trying to defend itself because AI safety rules stopped advanced models from analyzing the code used in the attack.
After the attack had begun, OpenCode found a workaround by getting access to AI models with fewer restrictions. This solved the immediate problem, but the team had already lost valuable time.
Axios described this as a growing problem for the security industry. Teams are racing to stop threats that use AI, but the AI models they depend on may suddenly refuse to help in the middle of an investigation.
This was not the first time an AI model refused
The OpenCode incident was similar to an earlier event. When Hugging Face suffered a breach in July 2026, AI models also refused similar requests to examine material related to the attack.
The old system involved in the OpenCode breach is also worth noting. It was already planned for retirement, but it remained active long enough for attackers to use it to get inside.
What this means for developers and AI providers
For developers, one clear lesson is to protect API keys carefully. Recommended practices include using different keys for different services and setting strict spending limits for each project.
For AI companies, safety rules are meant to prevent harm. But in this case, those rules slowed the people trying to stop an attack. If security teams decide that advanced AI models cannot be trusted to help during emergencies, they may build their systems around less restricted models from the beginning.
The quick actions by OpenAI, Anthropic, and Google show that these companies can respond quickly to problems involving charges and access. But an important question remains: can they give verified security teams a way to study attacks in greater detail without giving attackers the same ability?