OpenCode breached, OpenAI steps in to cover losses: API credits consumed by attack refunded to users

Beating AI News Flash: OpenAI's Head of Product and Platform, Thibault Sottiaux, stated that the team has partnered with OpenCode to help affected OpenAI API customers restore service and refund API credits consumed during the attack.

Previously, OpenCode disclosed that a soon-to-be-retired legacy system was compromised, potentially leaking user-hosted third-party model API keys, affecting 1.4% of Console users. Once attackers obtain the keys, they could impersonate users to call paid models. Community users have already reported anomalous charges amounting to hundreds of dollars.

In addition to addressing user losses, OpenAI also provided OpenCode with Daybreak Blue defense access. Previously, OpenCode co-founder Dax Raad complained that when the team used frontier models to investigate the attack, some requests were subject to safety restrictions. Daybreak Blue allows vetted security teams to reduce refusals during legitimate defensive tasks. Dax subsequently thanked OpenAI, stating that Daybreak played a key role in this defense and is still running continuously.

Tibo also reminded other security teams that they can apply for Daybreak Blue in advance, rather than waiting until they are under attack to seek authorization.