Anomaly Innovations, the company behind the open-source AI coding agent OpenCode, disclosed a security breach on October 17, 2026. Attackers got into a legacy system tied to its Console product and walked out with third-party API keys belonging to some of its users.
The more unusual part came during the cleanup. The AI models defenders wanted to use to dissect the attack code reportedly declined to help.
What happened inside OpenCode’s Console
According to the research findings, roughly 1.4% of OpenCode Console users had their API keys exposed. Those keys connected to outside AI providers, notably OpenAI, Anthropic, and Google.
That is what the attackers did. They used the stolen keys for large-scale activity, including model distillation, and the charges landed on legitimate users.
Model distillation is the practice of feeding a powerful model huge volumes of prompts and using its answers to train a cheaper copycat.
Reported unauthorized charges ranged from hundreds of dollars to more than $1,000 for some users.
Affected users received email notifications. The breached system was in the middle of being decommissioned, so it was on its way out when attackers found a way in.
The providers stepped in, the models stepped back
The AI providers whose keys were exposed moved to contain the damage. Anthropic and Google revoked the compromised keys.
OpenAI went a step further. Working with OpenCode, it refunded credits tied to the charges incurred during the breach.
OpenCode’s defensive work was hampered because AI guardrails stopped frontier models from analyzing the attack code.
OpenCode’s workaround was to gain access to less restricted AI models after the attack had already started. That fixed the immediate problem, but only after valuable time had passed.
Axios framed the issue as a growing headache across the security industry. Teams racing to counter AI-enabled threats are finding that the models they lean on can abruptly refuse to cooperate in the middle of an investigation.
Not the first time a model said no
The OpenCode incident echoes an earlier episode. During Hugging Face’s breach in July 2026, AI models also refused similar requests to analyze attack material.
The legacy angle deserves attention too. The breached system was already scheduled for retirement, yet it stayed live long enough to become the entry point.
What this means for developers and AI providers
For developers, the most direct lesson is about key hygiene. The recommended best practices from the incident are straightforward: use unique keys for different services and set hard spending limits per project.
For AI labs, their guardrails are meant to reduce harm, yet in this case they slowed the people trying to stop harm in progress. If defenders conclude that frontier models are unreliable during incidents, they may build workflows around less restricted alternatives from the start.
The quick response from OpenAI, Anthropic, and Google shows the providers can act fast on the billing and access side. The open question is whether they can offer verified defenders a path to deeper analysis without opening that same door to attackers.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy.