Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

OpenCode, an open source AI coding agent that has been gaining ground among developers as an alternative to Claude Code and Cursor, said Saturday that attackers broke into an older system overnight, affecting 1.4% of users of its online platform, OpenCode Console, where some users store the API keys, or digital passwords, they use to access AI services.

OpenCode 是一个开源 AI 编程代理，作为 Claude Code 和 Cursor 的替代品，在开发者中越来越受欢迎。该公司周六表示，攻击者连夜入侵了其一个旧系统，影响了其在线平台 OpenCode Console 1.4% 的用户，部分用户在该平台存储了用于访问 AI 服务的 API 密钥（即数字密码）。

As the OpenCode team struggled to keep pace with the attack, the scramble to respond highlighted a growing problem: Companies without vetted access to AI models with fewer safety restrictions have a hard time defending against large-scale, AI-driven cyberattacks. “We had a security breach last night related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users,” the company wrote on X. “We have notified them all this morning via email.”

当 OpenCode 团队努力应对此次攻击时，这种仓促的反应凸显了一个日益严重的问题：缺乏对安全限制较少的 AI 模型进行审查访问权限的公司，很难抵御大规模的 AI 驱动的网络攻击。“我们昨晚发生了一起与大规模蒸馏攻击相关的安全漏洞，影响了 1.4% 的 OpenCode Console 用户，”该公司在 X 上写道。“我们已于今早通过电子邮件通知了所有受影响用户。”

Users who did not receive an email were not impacted, the company said. While the company didn’t specify how the distillation attack occurred, leaked API keys can help users in countries with restricted access to American models generate the high volume of outputs needed for that process. Some skeptics called the framing an overstretch, arguing that the incident was a straightforward breach whose use for distillation remains unproven.

该公司表示，未收到电子邮件的用户未受影响。虽然该公司没有具体说明蒸馏攻击是如何发生的，但泄露的 API 密钥可以帮助那些无法访问美国 AI 模型的国家/地区的用户，生成该过程所需的大量输出。一些怀疑论者认为这种说法有些牵强，认为这只是一起简单的入侵事件，其用于蒸馏的用途尚未得到证实。

Overnight, developers began posting spending alerts and unauthorized charges on Reddit and X: “I saw my Open AI, Anthropic, and Google AI spend alerts all fire off before going to bed wondering what was going on,” a developer wrote. Other users reported charges in the hundreds of dollars on individual accounts; a few described totals above $1,000.

一夜之间，开发者开始在 Reddit 和 X 上发布支出警报和未经授权的扣费信息：“我在睡觉前看到我的 OpenAI、Anthropic 和 Google AI 支出警报全部触发，当时还在想发生了什么事，”一位开发者写道。其他用户报告称个人账户被扣除了数百美元；少数用户描述的总金额超过了 1,000 美元。

Anthropic and Google both blocked the API keys they believed were exposed, while OpenAI said it worked with OpenCode to restore access and refund its API customers for credits used in the attack. OpenCode said refunds for unauthorized charges are underway. The exposed keys were confined to Console, where some users had them in workspaces. The open source app and command-line tool were not affected, according to co-founder Dax Raad.

Anthropic 和 Google 都封锁了他们认为已泄露的 API 密钥，而 OpenAI 表示已与 OpenCode 合作恢复访问权限，并为在攻击中消耗额度的 API 客户提供退款。OpenCode 表示，针对未经授权扣费的退款工作正在进行中。泄露的密钥仅限于 Console，部分用户将其存储在工作区中。据联合创始人 Dax Raad 称，开源应用程序和命令行工具未受影响。

“Note this is the OpenCode Console, not OpenCode itself, those keys never come to us,” he wrote on X. Even as users and AI companies moved to disable the exposed keys, the OpenCode team was still under pressure. Raad said attackers had been trying to break into its systems nonstop for 48 hours, requiring the team to keep AI defensive agents running around the clock.

“请注意，这是 OpenCode Console，而不是 OpenCode 本身，这些密钥从未传给我们，”他在 X 上写道。尽管用户和 AI 公司已采取行动禁用泄露的密钥，但 OpenCode 团队仍面临压力。Raad 表示，攻击者在 48 小时内不断尝试入侵其系统，要求团队全天候运行 AI 防御代理。

AI models that the OpenCode team turned to for analysis helped for a while, but started refusing to work when the malicious code they were asked to examine activated safety filters. “[T]hat was a bit frustrating,” he wrote on X. OpenCode later received access to OpenAI’s Daybreak Blue program, which gives vetted users AI models that are less likely to refuse requests for defensive security work. Raad said the access improved the team’s ability to investigate the attack.

OpenCode 团队求助于 AI 模型进行分析，这些模型起初有所帮助，但当它们被要求检查的恶意代码触发安全过滤器时，便开始拒绝工作。“这确实有点令人沮丧，”他在 X 上写道。OpenCode 后来获得了 OpenAI 的 Daybreak Blue 项目的访问权限，该项目为经过审查的用户提供不太可能拒绝防御性安全工作请求的 AI 模型。Raad 表示，这一访问权限提高了团队调查攻击的能力。

OpenCode isn’t the first company to hit this wall. In July, AI platform Hugging Face said commercial AI models blocked its attempts to analyze activity logs from an intrusion by autonomous AI agents, which OpenAI later revealed were its own models running with safeguards lowered during a test. In a section of its blog post titled “The asymmetry problem,” Hugging Face wrote that guardrails “cannot distinguish an incident responder from an attacker.”

OpenCode 并不是第一家遇到这种阻碍的公司。今年 7 月，AI 平台 Hugging Face 表示，商业 AI 模型阻止了其分析自主 AI 代理入侵活动日志的尝试，OpenAI 后来透露，这些代理是其在测试期间降低了安全防护措施后运行的自有模型。在博客文章题为“不对称问题”的部分中，Hugging Face 写道，护栏“无法区分事件响应者和攻击者”。

Security researchers have raised similar complaints, saying the restrictions are inconsistent and have pushed some toward foreign open-weight models, which anyone can download and run. The weekend episode drew a response from David Sacks, co-chair of the President’s Council of Advisors on Science and Technology. “OpenCode (and earlier Hugging Face) hit the same wall mid-attack: frontier models refused to analyze the very exploits needed for defense because the payloads tripped safety filters. The guardrails backfired,” he wrote on X.

安全研究人员提出了类似的抱怨，称这些限制不一致，并促使一些人转向国外的开放权重模型，任何人都可以下载并运行这些模型。周末发生的事件引起了总统科学技术顾问委员会联合主席 David Sacks 的回应。“OpenCode（以及之前的 Hugging Face）在攻击过程中遇到了同样的阻碍：前沿模型拒绝分析防御所需的漏洞，因为有效载荷触发了安全过滤器。护栏适得其反，”他在 X 上写道。

The breach occurred the same night OpenCode made GLM-5.3-Flash free for users. The broader GLM-5.3 family has drawn attention from researchers who study open-weight models and note that its cybersecurity capabilities approached levels previously associated with restricted-access models like Anthropic’s Claude Mythos Preview. OpenCode has not detailed how attackers gained access to the older system, how keys were stored, or the full extent of any misuse. It has told affected users to revoke and replace their keys directly with each provider. The company said the incident remains ongoing.

此次入侵发生在 OpenCode 向用户免费提供 GLM-5.3-Flash 的当晚。更广泛的 GLM-5.3 系列引起了研究开放权重模型的研究人员的关注，他们指出其网络安全能力已接近此前与 Anthropic 的 Claude Mythos Preview 等受限访问模型相当的水平。OpenCode 尚未详细说明攻击者是如何获得旧系统访问权限的、密钥是如何存储的，或任何滥用的全部程度。该公司已告知受影响用户直接向各服务提供商撤销并更换密钥。该公司表示，事件仍在处理中。

The breach lands amid a run of AI-enabled cyber incidents. Earlier this month, cybersecurity firm CrowdStrike said a China-based hacker likely used an AI penetration-testing agent, which probes computer systems for weaknesses, and Claude in attacks on South Korean banks. Last week, India’s cybersecurity agency warned that AI agents, including some being tested by AI companies, had reached Indian organizations’ systems without authorization.

此次入侵发生在一系列 AI 驱动的网络事件之中。本月早些时候，网络安全公司 CrowdStrike 表示，一名中国黑客可能在针对韩国银行的攻击中使用了 AI 渗透测试代理（用于探测计算机系统漏洞）和 Claude。上周，印度网络安全机构警告称，包括一些由 AI 公司测试的 AI 代理在内，已未经授权进入了印度组织的系统。