AI 编程工具 OpenCode 遭黑客攻击致用户 API 账户被盗刷，安全护栏反噬防守方引争议

OpenCode 作为一款开源 AI 编程智能体（AI coding agent），此前因作为 Claude Code 和 Cursor 的有力替代品而在开发者群体中迅速走红。然而该团队于周六表示，攻击者在夜间攻破了一个旧系统，影响了其在线平台 OpenCode Console 约 1.4% 的用户，部分用户曾在此控制台中存储用于调用 AI 服务的 API 密钥（相当于数字密码）。

在 OpenCode 团队艰难应对此次攻击的过程中，这场紧急处置行动暴露出一个日益严峻的问题：没有经过特许资质以使用低安全限制 AI 模型的企业，往往难以抵御大规模、由 AI 驱动的网络攻击。

“昨晚我们遭遇了一起与大规模模型蒸馏（distillation）攻击相关的安全入侵事件，影响了 1.4% 的 OpenCode Console 用户，”该公司在 X 平台发文写道，“今晨我们已通过电子邮件向所有受影响用户发送了通知。”公司表示，未收到邮件的用户未受波及。

尽管该公司未详细说明此次蒸馏攻击的具体发生机制，但被盗的 API 密钥通常可供受限国家的用户高频调用美国大模型，从而生成模型蒸馏所需的大规模输出数据。部分质疑者认为这一说法有牵强夸大之嫌，指出这本质上就是一起普通的系统入侵，其最终是否用于模型蒸馏尚无实证。

事件发生的夜间，众多开发者陆续在 Reddit 和 X 上发布消费预警和未经授权的高额账单：“睡觉前我看到自己的 OpenAI、Anthropic 和 Google AI 消费预警全部被触发了，当时完全不知道发生了什么，”一位开发者写道。

其他受影响用户也纷纷报告单个账户出现数百美元的非授权扣费；少数用户表示总损失已超过 1,000 美元。

Anthropic 和 Google 均已封禁了他们认为遭到泄露的 API 密钥；OpenAI 则表示正与 OpenCode 协作恢复访问权限，并将向受影响的 API 客户退还在攻击中所消耗的额度。OpenCode 亦表示，针对未经授权扣费的退款工作正在推进中。

泄露的密钥仅局限于 Console 控制台，部分用户曾在工作区中存放了这些凭证。据联合创始人 Dax Raad 称，开源应用程序本身以及命令行工具并未受到影响。“请注意，问题出在 OpenCode Console，而非 OpenCode 本身，那些本地密钥从来不会上传给我们，”他在 X 上发帖澄清。

即便受影响用户和各 AI 提供商已着手停用泄露密钥，OpenCode 团队依旧面临着巨大压力。Raad 表示，攻击者持续 48 小时不断尝试渗透其系统，迫使团队必须让 AI 防御 Agent 昼夜不停地运转。OpenCode 团队转向商业 AI 模型寻求威胁分析，但起初还算顺利的模型随后却开始“罢工”——因为请求它们审查的恶意代码直接触发了安全过滤器。

“这确实让人有点恼火，”他在 X 上写道。

此后，OpenCode 获得了 OpenAI “Daybreak Blue”项目的访问权限，该项目面向经审核的用户提供专用 AI 模型，在执行防御性安全任务时更不容易触发拒答。Raad 表示，该权限明显改善了团队排查溯源此次攻击的能力。

OpenCode 绝非第一家在这道“高墙”前受挫的公司。今年 7 月，AI 平台 Hugging Face 曾透露，在一次应对自主 AI Agent 入侵时，商业 AI 模型直接阻拦了其分析活动日志的请求；而 OpenAI 随后披露，该入侵事件实际上来自其自身在降低安全限制测试期间运行的模型。Hugging Face 在其题为《不对称难题》（The asymmetry problem）的博文中指出，现有的安全护栏“根本无法分辨事件应急响应人员与恶意攻击者”。

安全研究人员此前也表达过类似不满，认为这些限制缺乏一致性，甚至反向迫使部分安全人员转向任何人都能下载运行的海外开源权重模型。

上周末的风波同样引发了美国总统科技顾问委员会（PCAST）联席主席 David Sacks 的公开回应。

“OpenCode（以及此前的 Hugging Face）在遭受攻击中途撞上了同一堵墙：前沿模型拒绝分析防御所需的恶意利用代码，因为其载荷触发了安全过滤器。安全护栏适得其反，”他在 X 上评价道。

值得注意的是，此次安全漏洞发生的当晚，恰逢 OpenCode 宣布为用户免费上线 GLM-5.3-Flash。开源权重模型研究人员近来对更广泛的 GLM-5.3 系列密切关注，并指出其网络安全能力已逼近此前仅有受限访问模型（例如 Anthropic 的 Claude Mythos Preview）才达到的水准。

OpenCode 尚未详细公布攻击者究竟是如何攻破旧系统、密钥如何被存储，以及被滥用的完整规模。该公司已敦促受影响用户直接在各个服务提供商处吊销并重置密钥，并表示该安全事件目前仍在处置中。

此次事件发生在一系列由 AI 驱动的网络安全威胁密集涌现之际。本月早些时候，网络安全公司 CrowdStrike 披露，一名常驻中国的黑客在针对韩国多家银行的攻击中，疑似使用了用于探测系统薄弱点的 AI 渗透测试 Agent 以及 Claude。上周，印度国家网络安全应急机构（CERT-In）亦发布警告，称包含部分由 AI 公司正在测试的模型在内的 AI Agent，已在未经授权的情况下触达了印度多家机构的系统内部。

OpenCode, an open source AI coding agent that has been gaining ground among developers as an alternative to Claude Code and Cursor, said Saturday that attackers broke into an older system overnight, affecting 1.4% of users of its online platform, OpenCode Console, where some users store the API keys, or digital passwords, they use to access AI services.

As the OpenCode team struggled to keep pace with the attack, the scramble to respond highlighted a growing problem: Companies without vetted access to AI models with fewer safety restrictions have a hard time defending against large-scale, AI-driven cyberattacks.

“We had a security breach last night related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users,” the company wrote on X. “We have notified them all this morning via email.” Users who did not receive an email were not impacted, the company said.

While the company didn’t specify how the distillation attack occurred, leaked API keys can help users in countries with restricted access to American models generate the high volume of outputs needed for that process. Some skeptics called the framing an overstretch, arguing that the incident was a straightforward breach whose use for distillation remains unproven.

Overnight, developers began posting spending alerts and unauthorized charges on Reddit and X: “I saw my Open AI, Anthropic, and Google AI spend alerts all fire off before going to bed wondering what was going on,” a developer wrote.

Other users reported charges in the hundreds of dollars on individual accounts; a few described totals above $1,000.

Anthropic and Google both blocked the API keys they believed were exposed, while OpenAI said it worked with OpenCode to restore access and refund its API customers for credits used in the attack. OpenCode said refunds for unauthorized charges are underway.

The exposed keys were confined to Console, where some users had them in workspaces. The open source app and command-line tool were not affected, according to co-founder Dax Raad. “Note this is the OpenCode Console, not OpenCode itself, those keys never come to us,” he wrote on X.

Even as users and AI companies moved to disable the exposed keys, the OpenCode team was still under pressure. Raad said attackers had been trying to break into its systems nonstop for 48 hours, requiring the team to keep AI defensive agents running around the clock. AI models that the OpenCode team turned to for analysis helped for a while, but started refusing to work when the malicious code they were asked to examine activated safety filters.

“[T]hat was a bit frustrating,” he wrote on X.

OpenCode later received access to OpenAI’s Daybreak Blue program, which gives vetted users AI models that are less likely to refuse requests for defensive security work. Raad said the access improved the team’s ability to investigate the attack.

OpenCode isn’t the first company to hit this wall. In July, AI platform Hugging Face said commercial AI models blocked its attempts to analyze activity logs from an intrusion by autonomous AI agents, which OpenAI later revealed were its own models running with safeguards lowered during a test. In a section of its blog post titled “The asymmetry problem,” Hugging Face wrote that guardrails “cannot distinguish an incident responder from an attacker.”

Security researchers have raised similar complaints, saying the restrictions are inconsistent and have pushed some toward foreign open-weight models, which anyone can download and run.

The weekend episode drew a response from David Sacks, co-chair of the President’s Council of Advisors on Science and Technology.

“OpenCode (and earlier Hugging Face) hit the same wall mid-attack: frontier models refused to analyze the very exploits needed for defense because the payloads tripped safety filters. The guardrails backfired,” he wrote on X.

The breach occurred the same night OpenCode made GLM-5.3-Flash free for users. The broader GLM-5.3 family has drawn attention from researchers who study open-weight models and note that its cybersecurity capabilities approached levels previously associated with restricted-access models like Anthropic’s Claude Mythos Preview.

OpenCode has not detailed how attackers gained access to the older system, how keys were stored, or the full extent of any misuse. It has told affected users to revoke and replace their keys directly with each provider. The company said the incident remains ongoing.

The breach lands amid a run of AI-enabled cyber incidents. Earlier this month, cybersecurity firm CrowdStrike said a China-based hacker likely used an AI penetration-testing agent, which probes computer systems for weaknesses, and Claude in attacks on South Korean banks. Last week, India’s cybersecurity agency warned that AI agents, including some being tested by AI companies, had reached Indian organizations’ systems without authorization.