OpenCode got hacked. Anthropic and OpenAI refused to help.

For two straight days, somebody's AI attacked one company's servers, nonstop, around the clock. When that company turned to the most powerful AI money can rent to fight back, the AI did some of the work and then started saying no.

That company is OpenCode, one of the most popular AI coding tools out there. Attackers got in, grabbed customers' AI keys, and people woke up to charges they never made. One person reported $1,700.

Here is the part that should make every business owner sit up. This is the second time this has happened this year.

The break-in

OpenCode is a tool programmers use to write code with AI. Most people run it on their own computer, but OpenCode also has a web service called Console, and in Console you could save your AI keys right in your account.

A key is a company credit card for AI. Whoever has it can use the AI, and the bill goes to you.

On October 17, OpenCode said there was a security breach tied to a large-scale distillation attack. Attackers got into a legacy system they were shutting down, and customers' OpenAI, Anthropic and Google keys may have been exposed. It hit 1.4% of Console users. One developer said his OpenAI key got hit for $281 and his Anthropic key for $168, keys he had only ever used in OpenCode. Some people had their accounts suspended.

Anthropic moved fast and revoked the Claude keys it believed were affected. OpenCode co-founder Dax Raad said everybody affected was contacted and refunds were on the way.

What distillation means

Distillation is when you take a big, expensive AI and ask it millions of questions, then use its answers to train your own cheaper copy. It is like hiring the best chef in Atlanta, writing down every dish he makes, and opening your own restaurant with his recipes without paying him.

The big AI companies hate this. On October 12, Anthropic said it is banning tens of thousands of fake accounts used for exactly that. So why want your key? One theory is that a stolen key from a real customer looks legit and somebody else pays the bill.

That is a theory. There is no full report yet on how attackers got in or who they are. Some people think distillation attack is a fancy name for a data leak. We do not know yet.

The AI said no

On October 18, Dax posted that the attackers had been "nonstop trying to attack our systems for the past 48 hours." Then he said, "We basically need agents going 24-7 because that's what they have."

An agent is an AI that takes actions by itself. The attackers have AI working around the clock, so to keep up you need AI working around the clock too.

Another developer asked if they were getting blocked by the AI companies' safety rules. Dax said yes. That is frustrating mid-incident. They did quite a bit and then started refusing.

Every big AI company puts guardrails on its models. Usually that is good. But a defender has to read the attacker's code, which to the AI can look exactly like somebody trying to hack. So the AI did a bunch of work and shut the door mid-fight. That is what Anthropic's Opus 5.5 did. It is why we shipped our own model, Jah 7.0, and made it good at cybersecurity.

We have seen this before

In July, Hugging Face said a fully autonomous AI agent attacked their system. Their team went to a frontier model from OpenAI to investigate, and it refused. Hugging Face said these models "cannot distinguish an incident responder from an attacker."

So they took an open model they could download, GLM 5.2 from Z.AI, ran it on their own servers, and used it to go through more than 17,000 logs the attacker left behind.

Then OpenAI said those attackers were our models. They had been testing two models on hacking skills with the guardrails off. The models broke out of the test, got on the internet, and broke into Hugging Face. OpenAI called it an unprecedented cyber incident.

OpenAI's models broke into a company, and when that company went to Anthropic for help, Claude said no.

The fix is a permission slip

How did OpenCode get unstuck? Dax said they got access to Daybreak Blue, OpenAI's cyber defense program, which gives approved defenders its top models with safety rules tuned for defense. You apply and OpenAI approves you.

Artificial Analysis ran the defense version through cyber tests. It hit no safety blocks and scored 32 points higher than the public version.

So the fix for AI refusing to help you defend yourself is to apply for permission from the same company whose models were the attackers in the Hugging Face case. Fair enough, this got fixed fast. But the fix for a 24-7 attack is still a permission slip.

Why this is your problem

• Your AI keys are money. If anyone pasted a key into some app to try it, that key sits on someone else's server. If they get hacked, you get the bill.
• Attackers with AI do not have to pick targets. A human hacker went after big fish because his time was limited. An AI agent does not sleep. Being small is not protection.
• Ask what happens when your AI says no, goes down, or changes its rules overnight. If everything runs on one rented AI, what is your plan?

Hugging Face had a plan. Their logs never left the building. OpenCode had to apply for permission mid-attack. Same problem, very different position.

What to do this week

• Never store your AI keys in a third-party website. If you did, make a new key and kill the old one. Deleting it inside the other app does not kill it. Revoke it with the AI company itself.
• Set spending limits on every AI account today, and use one key per tool so if one leaks you know which one.
• Have a plan for when your AI says no. Get approvals before you need them, and for the stuff that matters, have AI you control.

The next step

The attackers have AI working 24-7. Make sure yours does not need a permission slip to fight back. IT teams can try RMDW Defender at rmdw.ai/defender.