Getting Blocked By AI Agent Cyber Safeguards While Fighting Malicious AI Agents, Says OpenCode Co-Founder Dax Raad After Hack

OpenCode co-founder Dax Raad said on October 18 that his team fended off "non stop" AI-agent intrusion attempts for 48 hours while frontier models refused to assist mid-incident, until the team gained access to an OpenAI Daybreak "daybreak blue" access tier. OpenCode disclosed that a breach of a legacy internal system, described as a "large scale distillation attack," may have exposed a subset of users' OpenAI, Anthropic and Google API keys, affecting roughly 1.4% of OpenCode Console users, and the company said it is working directly with Anthropic, OpenAI and Google to remediate. The episode highlights that cybersecurity guardrails built into frontier models can also block legitimate defenders investigating a live breach against their own systems.

An interesting dynamic has opened up as legitimte businesses take on AI-agent-led cyberattacks on their systems. OpenCode co-founder Dax Raad has given a rare, real-time look at what it’s like on the defending side of an active AI-powered attack, saying his team has been fending off “non stop” intrusion attempts for 48 hours straight, even as the very frontier models they rely on for incident response kept refusing to help. In a post on X on the morning of October 18, Raad wrote that “they’ve been non stop trying to attack our systems for the past 48 hours,” adding that “a side effect is everything is getting hardened but damn we basically need agents going 24/7 because that’s what they have.” The post, cam after after OpenCode disclosed that a breach of a legacy internal system may have exposed a subset of users’ OpenAI, Anthropic and Google API keys https://officechai.com/ai/opencode-discloses-security-breach-says-attackers-may-have-accessed-users-openai-anthropic-and-google-api-keys/ , in what the company described as a “large scale distillation attack” affecting roughly 1.4% of OpenCode Console users. When the safety model gets in the way of the security team The more striking admission came in a reply to a follower, developer Rhys Sullivan, who asked whether Raad’s team was “getting blocked by cyber safe guards at all with frontier models” while trying to investigate the attack. Raad’s answer was blunt: “yes that was a bit frustrating mid incident when trying to investigate. they did quite a bit and then started refusing.” He added that the team has since “got access to daybreak blue now so it’s better,” a reference to an access tier of OpenAI Daybreak, a cybersecurity initiative that provides authorized defenders with governed access to frontier AI models The episode captures an awkward bind that security teams at AI-native companies are increasingly running into: the same cybersecurity guardrails that frontier labs build into their models to stop those models being misused for hacking can also throttle legitimate defenders trying to use AI agents to investigate a live breach against their own systems. A model asked to analyze suspicious traffic patterns, trace an intrusion, or reason about exploit mechanics can look, to an automated safety classifier, indistinguishable from an attacker asking the same model for help attacking someone else. Attackers that don’t sleep Raad’s framing, that defenders “basically need agents going 24/7 because that’s what they have,” points to a broader shift already underway in offensive security: adversaries increasingly running AI agents against targets continuously rather than relying on human operators working in shifts. That mirrors warnings raised elsewhere in the industry this year. Security researchers at Datadog, among others, have tracked AI agents being used to probe and compromise vulnerable systems at scale https://officechai.com/ai/ai-labs-have-disclosed-that-their-models-reached-indian-systems-without-authorization-says-indias-cybersecurity-body/ , while India’s own cybersecurity nodal agency recently said multiple AI labs had disclosed that their models had reached Indian systems without authorization. OpenCode itself has not been a stranger to this kind of scrutiny before: a critical remote-code-execution flaw in the tool, tracked as CVE-2026-22812, was disclosed and patched earlier in 2026. A distillation attack, not just a credential theft OpenCode has maintained that this week’s incident goes beyond simple credential theft. The company has said it is working directly with Anthropic, OpenAI and Google to remediate the breach, consistent with its description of the attack as aimed at extracting large volumes of model output through compromised accounts rather than purely exfiltrating data. Distillation, the practice of using a model’s outputs at scale to train a rival model more cheaply, has become a live commercial concern for frontier labs: Anthropic has told investors that unauthorized distillation by rival labs measurably dented its own revenue https://officechai.com/ai/5-7-of-our-revenue-was-because-of-rival-labs-distillation-anthropic-tells-investors/ , and OpenAI has separately disrupted coordinated campaigns designed to extract its models’ reasoning traces. Raad has not said whether OpenCode’s systems are now fully secured or whether the 48-hour window of attacks has ended. For now, the episode stands as a pointed illustration of a problem only AI-native companies run into: fighting an AI-assisted attacker while the AI you’d use to fight back occasionally decides you’re the attacker.