The attack, which occurred Saturday overnight, affected 1.4% of OpenCode Console users who stored API keys for AI services. Users reported unauthorized charges ranging from hundreds to over $1,000. OpenCode co-founder Dax Raad noted that their AI models, when asked to examine malicious code, activated safety filters and refused to work, hindering their defense efforts. OpenCode later gained access to OpenAI’s Daybreak Blue program, which provides AI models with fewer safety restrictions for defensive security work. OpenAI, Anthropic, and Google have blocked exposed API keys, and refunds for unauthorized charges are underway.