OpenCode 是一款开源 AI 编程代理，在开发者中作为 Claude Code 和 Cursor 的替代方案逐渐获得认可，该公司周六表示，攻击者在周五夜间闯入了一个旧系统，影响了其在线平台 OpenCode Console 上 1.4% 的用户，部分用户在此平台上存储了用于访问 AI 服务的 API 密钥，即数字密码。
OpenCode, an open-source AI coding agent that has been gaining ground among developers as an alternative to Claude Code and Cursor, said Saturday that attackers broke into an older system overnight, affecting 1.4% of users of its online platform, OpenCode Console, where some users store the API keys, or digital passwords, they use to access AI services.
随着 OpenCode 团队努力跟上攻击节奏，应对混乱凸显了一个日益严重的问题：没有经过审查的 AI 模型访问权限、且这些模型安全限制较少的公司，很难抵御大规模的 AI 驱动网络攻击。
As the OpenCode team struggled to keep pace with the attack, the scramble to respond highlighted a growing problem: companies without vetted access to AI models with fewer safety restrictions have a hard time defending against large-scale, AI-driven cyberattacks.
“我们昨晚遭遇了一起与大规模蒸馏攻击相关的安全漏洞，影响了 1.4% 的 OpenCode Console 用户，”该公司在 X 上写道。“我们今天早上已通过电子邮件通知了所有受影响用户。”公司表示，未收到电子邮件的用户未受影响。
“We had a security breach last night related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users,” the company wrote on X. “We have notified them all this morning via email.”Users who did not receive an email were not impacted, the company said.
公司未具体说明蒸馏攻击是如何发生的，但泄露的 API 密钥可帮助美国模型访问受限国家的用户生成该过程所需的大量输出。一些怀疑者认为这种表述过于牵强，认为该事件是一起简单的泄露，其用于蒸馏的情况尚未得到证实。
While the company didn’t specify how the distillation attack occurred, leaked API keys can help users in countries with restricted access to American models generate the high volume of outputs needed for that process. Some skeptics called the framing an overstretch, arguing that the incident was a straightforward breach whose use for distillation remains unproven.
周五夜间，开发者开始在 Reddit 和 X 上发布支出警报和未经授权的费用信息。“我睡前看到 OpenAI、Anthropic 和 Google AI 的支出警报全部触发，心里想着发生了什么，”一名开发者写道。
Overnight, developers began posting spending alerts and unauthorized charges on Reddit and X. “I saw my Open AI, Anthropic, and Google AI spend alerts all fire off before going to bed wondering what was going on,” a developer wrote.
其他用户报告称，单个账户出现了数百美元的费用；少数人表示总额超过 1000 美元。
Other users reported charges in the hundreds of dollars on individual accounts; a few described totals above $1,000.
Anthropic 和 Google 都封锁了他们认为已泄露的 API 密钥，而 OpenAI 表示已与 OpenCode 合作恢复访问权限，并为其 API 客户退还攻击中使用的积分。OpenCode 表示，未经授权费用的退款正在进行中。
Anthropic and Google both blocked the API keys they believed were exposed, while OpenAI said it worked with OpenCode to restore access and refund its API customers for credits used in the attack. OpenCode said refunds for unauthorized charges are underway.
暴露的密钥仅限于 Console，一些用户在工作区中存有这些密钥。根据联合创始人 Dax Raad 的说法，开源应用和命令行工具未受影响。他在 Even 上写道：“请注意，这是 OpenCode Console，而不是 OpenCode 本身，这些密钥永远不会传达给我们。”随着用户和 AI 公司采取行动禁用暴露的密钥，OpenCode 团队仍面临压力。
The exposed keys were confined to Console, where some users had them in workspaces. The open-source app and command-line tool were not affected, according to co-founder Dax Raad. “Note this is the OpenCode Console, not OpenCode itself, those keys never come to us,” he wrote on Even as users and AI companies moved to disable the exposed keys, the OpenCode team was still under pressure.
Raad 表示，攻击者一直在不间断地尝试 48 小时入侵其系统，迫使团队必须让 AI 防御代理全天候运行。OpenCode 团队用于分析的 AI 模型起初有所帮助，但当被要求检查的恶意代码触发安全过滤器时，这些模型开始拒绝工作。
Raad said attackers had been trying to break into its systems nonstop for 48 hours, requiring the team to keep AI defensive agents running around the clock. AI models that the OpenCode team turned to for analysis helped for a while, but started refusing to work when the malicious code they were asked to examine activated safety filters.
“[T]这有点令人沮丧，”他在 OpenCode 上写道。随后，OpenCode 获得了 OpenAI 的 Daybreak Blue 计划的访问权限，该计划为经过审查的用户提供不太可能拒绝防御性安全工作请求的 AI 模型。Raad 表示，此次访问提升了团队调查攻击的能力。
“[T]hat was a bit frustrating,” he wrote on OpenCode later received access to OpenAI’s Daybreak Blue program, which gives vetted users AI models that are less likely to refuse requests for defensive security work. Raad said the access improved the team’s ability to investigate the attack.
OpenCode 并非首次遇到此类问题的公司。7 月，AI 平台 Hugging Face 表示，商业 AI 模型阻止了其分析由自主 AI 代理发起的入侵活动日志的尝试，而 OpenAI 后来透露，这些模型正是其自身在测试期间降低防护措施后运行的模型。在其博客文章中题为“非对称问题”的章节中，Hugging Face 写道：“防护栏无法区分事件响应者和攻击者。”安全研究人员也提出了类似抱怨，称这些限制不一致，并促使一些人转向任何人都可以下载和运行的外国开放权重模型。
OpenCode isn’t the first company to hit this wall. In July, AI platform Hugging Face said commercial AI models blocked its attempts to analyze activity logs from an intrusion by autonomous AI agents, which OpenAI later revealed were its own models running with safeguards lowered during a test. In a section of its blog post titled “The asymmetry problem,” Hugging Face wrote that guardrails “cannot distinguish an incident responder from an attacker.”Security researchers have raised similar complaints, saying the restrictions are inconsistent and have pushed some toward foreign open-weight models, which anyone can download and run.
此次周末事件引来了总统科学技术顾问委员会联席主席 David Sacks 的回应。
The weekend episode drew a response from David Sacks, co-chair of the President’s Council of Advisors on Science and Technology.
“OpenCode（以及更早的Hugging Face）在攻击过程中遇到了同样的障碍：前沿模型拒绝分析防御所需的利用方式，因为有效载荷触发了安全过滤器。防护措施适得其反。”他写道。该事件发生在OpenCode将GLM-5.3-Flash免费提供给用户的同一天。更广泛的GLM-5.3系列模型引起了研究开放权重模型的研究者们的关注，他们指出其网络安全能力已达到此前仅限于受限访问模型（如Anthropic的Claude Mythos Preview）才具备的水平。
“OpenCode (and earlier Hugging Face) hit the same wall mid-attack: frontier models refused to analyze the very exploits needed for defense because the payloads tripped safety filters. The guardrails backfired,” he wrote on The breach occurred the same night OpenCode made GLM-5.3-Flash free for users. The broader GLM-5.3 family has drawn attention from researchers who study open-weight models and note that its cybersecurity capabilities approached levels previously associated with restricted-access models like Anthropic’s Claude Mythos Preview.
OpenCode尚未详细说明攻击者是如何进入旧系统的，密钥是如何存储的，或被滥用的全部范围。该公司已告知受影响的用户直接向各提供商撤销并更换他们的密钥。公司表示，该事件仍在进行中。
OpenCode has not detailed how attackers gained access to the older system, how keys were stored, or the full extent of any misuse. It has told affected users to revoke and replace their keys directly with each provider. The company said the incident remains ongoing.
此次事件发生在一系列由AI推动的网络安全事件之中。本月早些时候，网络安全公司CrowdStrike表示，一名来自中国的黑客可能使用了一个AI渗透测试代理——该代理用于探测计算机系统中的弱点——以及Claude，对韩国银行发动了攻击。上周，印度网络安全机构警告称，包括一些正在被AI公司测试的AI代理在内的AI代理，已未经授权进入印度组织的系统。
The breach lands amid a run of AI-enabled cyber incidents. Earlier this month, cybersecurity firm CrowdStrike said a China-based hacker likely used an AI penetration-testing agent, which probes computer systems for weaknesses, and Claude in attacks on South Korean banks. Last week, India’s cybersecurity agency warned that AI agents, including some being tested by AI companies, had reached Indian organizations’ systems without authorization.