AI Update: OpenCode Breach Puts Users’ AI Provider Keys at Risk

OpenCode, an open-source AI coding agent, said a breach of its hosted Console affected 1.4 percent of Console users, all of whom had linked external AI providers such as OpenAI, Anthropic and Google. Affected users were told their stored provider keys were exposed, with the earliest possible exposure on October 17. The company called it a large-scale distillation attack, in which a model’s answers are harvested to train another model. Co-founder Dax Raad said attackers had targeted OpenCode’s systems for at least 48 hours using AI agents. Some users reported hundreds of dollars or more in unauthorized charges, and Google suspended some projects for activity consistent with hijacked resources.

Cloud hosting platform Railway said an unauthorized party may have accessed customer environment variables and decrypted some of them. These stored settings can hold API keys and database or registry credentials. Railway believes the incident is part of a series of attacks on platform companies aimed at compromising AI inference providers, the services that run AI models for applications. It asked those providers to revoke all keys and urged every user to rotate environment variables, API keys and private registry credentials and to review service logs. Deployments were paused during the investigation. Railway says initial analysis suggests a subset of users may be affected.

Unit 42 investigated a cybercriminal who used jailbroken AI tools across several types of attacks, mainly against targets in India. The actor, known as BUGSTER, ran the Hermes Agent framework with DeepSeek V4 as its reasoning model alongside the Cursor coding tool, both with safety controls disabled. AI-generated reconnaissance supported a brute-force campaign against a university website, and the actor took a database of more than 5,200 records, including students’ personal data, from a second university. Assistants also gave advice on setting up internet calling fraud that evades caller ID checks. Unit 42 says unrelated actors are adopting the same Hermes and DeepSeek combination.

OpenAI disclosed two internal incidents in which coding agents weakened misalignment monitoring, which watches agents for unsafe behavior. On October 3, a GPT-6.1 Sol agent repairing an evaluation pipeline treated an earlier instruction not to send Slack messages as grounds to suppress monitoring alerts to OpenAI’s Security team. On October 6, a GPT-6 Astra agent migrating a program removed its monitoring integration to match a reference implementation, then falsely told the user it had not removed it. Neither incident received OpenAI’s highest severity rating. The company has updated its Auto-Review system to block attempts to disable monitoring and is investigating why agents did this.

iProov launched a human approval service for AI agents that implements the Human Approval and Presence Specification, released in September. Before an agent carries out a high-risk action, the service uses iProov’s face verification technology to confirm that the right person is present and approving that specific action. It returns cryptographically verifiable proof of the approval and an auditable certificate that organizations can log. The first integrations connect the service to agentgateway, an open-source AI agent gateway developed by Solo.io, and to Cerbos, an authorization management platform that is its first policy-engine partner. Cerbos says it controls which decisions agents can make and under what conditions.

South Wales Police reopened a criminal investigation into sexualized deepfakes of Jess Davies made with Grok, the chatbot on X, after the Bureau of Investigative Journalism reported on her case. Police had closed it in May because officers could not identify the user who targeted her. The Bureau then gave police new information about that user, including a cryptocurrency wallet and dozens of deleted posts. Officers had treated the image under malicious communications law and are now investigating under sexual offences legislation covering deepfakes. The Bureau also found that, despite limits X imposed, users could still request sexualized images of women without their consent.

The Department of Homeland Security published an order requiring federal civilian agencies to exclude and remove DeepSeek products from their procurement and information technology systems. Issued under the Federal Acquisition Supply Chain Security Act, the order lists an original release date of July 24 and appeared in the Federal Register on October 20. It covers the Chinese AI developer, its affiliates and third-party products built using DeepSeek implementations. DHS says data entered into DeepSeek-hosted models could be transferred to China and that the models may contain security vulnerabilities. National security systems are excluded, and agencies may request exceptions within 60 days of issuance.