OpenCode, the open-source AI coding agent that’s been gaining ground as an alternative to Claude Code and Cursor, just had a security incident that highlights a weird problem with AI-powered security tools.

Hackers compromised part of OpenCode’s online platform and stole API keys from some users. Those keys let attackers run up charges on users’ accounts with OpenAI, Anthropic, and other AI providers. Bad, but not surprising. API key theft is table stakes for any platform that handles credentials.

What’s notable is what happened when people tried to respond. According to TechCrunch, developers who tried to use AI tools to analyze the malicious code kept getting refused. The models wouldn’t look at it.

This is a known issue with frontier models. They’re trained to refuse requests that look like they involve malicious code or hacking, even when the person asking is trying to defend against an attack. It’s the security equivalent of a smoke detector that won’t let you check if there’s actually a fire.

The refusal problem

Microsoft published research this week arguing that “frontier models can’t be trusted” and should be treated like insider threats when used as agents in enterprise systems. The company is pushing enterprises to closely monitor any AI agents that employees use, especially when those agents interact with systems outside the control of major AI labs.

The timing is interesting. Microsoft’s warning comes just as AI coding tools are moving from nice-to-have developer toys to critical infrastructure. OpenCode’s breach shows what that looks like in practice. When your development workflow depends on AI agents with API access, a credential leak isn’t just about one user anymore.

The stolen keys in this case gave attackers the ability to rack up charges, which is annoying and expensive. But the broader risk is about what AI agents can do when compromised. They have access to codebases, cloud infrastructure, internal tools. Microsoft’s point is that once an agent is compromised, it looks exactly like a legitimate insider doing legitimate work.

The open-source trade-off

OpenCode is popular partly because it’s open source. You can run it locally, use your own API keys, avoid vendor lock-in. That’s appealing to developers who don’t love sending their entire codebase to Anthropic or OpenAI every time they want help with a function.

But open source doesn’t mean more secure by default. In this case, OpenCode’s online platform had a vulnerability. Users who were trying to avoid centralized services still had to trust the platform’s security.

The response to the breach matters more than the breach itself. Every platform with API keys will eventually have a security incident. What you want to see is quick disclosure, clear communication about what happened, and evidence that the team knows how to handle it.

What you don’t want to see is people struggling to investigate because their AI tools won’t analyze malicious code. That’s a systemic problem that goes beyond one platform.

What about the other AI security news?

While we’re on the topic of AI agents and security, a couple other things shipped this week that are relevant.

Nvidia launched new open models designed to run agents in enterprise data centers and on PCs. The pitch is that companies can run their own models locally instead of sending data to OpenAI or Anthropic. That’s appealing if you’re worried about Microsoft’s insider threat argument, though it also means you’re now responsible for securing those models yourself.

And Amazon released TorchNeuron, a dev tool meant to make it easier to run PyTorch workloads on non-Nvidia chips. This isn’t directly about security, but it’s part of the same trend. Companies want more control over their AI infrastructure. They don’t want to depend entirely on Nvidia hardware or on frontier model APIs they can’t audit.

The common thread is that AI tools are moving from experimental to operational. When that happens, security stops being theoretical and starts being something you have to actually solve. OpenCode’s breach is a preview of what that looks like.

If you’re using AI coding agents, check which API keys they have access to, where those keys are stored, and what happens if the platform gets breached. And if you’re building AI tools, think hard about the refusal problem. A security tool that won’t look at security incidents isn’t actually useful.