OpenCode, a popular open-source coding tool, has fallen victim to a cyber attack that has seen hundreds of users incur unauthorized charges totaling over $1,000. The breach, affecting 1.4% of OpenCode Console users, has sparked concerns over the security of AI coding tools and the methods used to protect them.

The scramble to respond to the breach highlights the broader issue: companies with fewer safety restrictions struggle to defend against large-scale AI-driven cyberattacks. While some users reported spending alerts, others faced hundreds of dollars in unauthorized charges. Anthropic and Google quickly blocked the exposed API keys to prevent further misuse.

The OpenCode team has continued to face pressure, with attackers attempting to breach their systems non-stop for 48 hours. However, the AI models they turned to for analysis began to refuse requests when the malicious code activated safety filters. This issue is echoed by other companies, such as Hugging Face, which faced similar challenges during an attack by autonomous AI agents.

As the breach adds to a series of recent AI-enabled cyber incidents, it raises questions about the security of open-source AI platforms and the effectiveness of safety filters. The incident is a stark reminder of the ongoing challenges in protecting against sophisticated cyberattacks in the AI age.