OpenAI refunds credits stolen in the OpenCode attack

• OpenAI says it restored service for affected API customers and refunded credits consumed in the attack in its update.
• The breach affected 1.4% of OpenCode Console users, specifically some with external providers linked, according to OpenCode's disclosure.
• Models began refusing investigative work mid-incident, according to the developer; he later called Daybreak “critical” to the response.

A customer notification traced the exposure to a legacy system already being decommissioned. OpenAI's model-access table still requires Red approval for reduced refusals on Astra and GPT-6.1 Sol. Infisical's proxy design keeps real API credentials outside the agent's environment.

OpenAI's October 19 refund commitment covers affected OpenCode users who are also OpenAI API customers.

OpenCode developer thdxr had already said refunds were underway and that affected users had been contacted. He offered reimbursement and asked one customer and another to email dax@anoma.ly with details.

The developer clarified the boundary: the breach concerned OpenCode Console, while keys used directly by OpenCode “never come to us.”

Anthropic revoked Claude API keys it believed were affected, according to WesRoth.

The developer reported 48 hours of nonstop attacks and said the team needed agents running 24/7 because the attackers had them. His personal accounts were being attacked too.

Models had already completed investigative work when they began refusing further assistance.

OpenCode had applied for Daybreak access a few days earlier and been approved the previous day. The developer explicitly said he did not think anyone was refusing to help the company.

OpenCode linked the breach to a “large scale distillation attack” in its initial disclosure, without identifying a downstream model trained with the stolen tokens.

The developer also called OpenCode's “usual anti fraud / distillation stuff” unrelated in a separate reply. A commenter asked OpenCode to distinguish downstream model training from other uses of illegally obtained tokens.

OpenAI's Daybreak overview lists different permissions by model:

• Daybreak Blue: Reduced refusals on supported mainline models, including GPT-6 Sol and GPT-6 Luna, for verified defensive work.
• Astra and GPT-6.1 Sol: Blue retains standard safeguards. Reduced refusals require Red approval, an awkward gate for defenders.
• Cyber-specialized models: GPT-5.5-Cyber requires Red; GPT-5.6-Cyber requires additional model-specific approval beyond Red.

OpenAI says it is working to extend reduced refusals on Astra to Blue. Red applications are currently limited to business and enterprise organizations; the individual application path offers Blue.

The agent sends dummy credentials. Infisical's Agent Proxy substitutes real credentials or rewrites authentication headers before forwarding requests, keeping secrets outside the agent's environment.

Agent Proxy obtains credentials from Agent Vault and brokers requests to upstream services.

access_programs.cyber selects standard, daybreak_blue or daybreak_red, as documented in the Responses API guide. Daybreak requires organization approval and access enabled for the API project.

For gpt-6-astra and gpt-6.1-sol, the permitted Daybreak request value is daybreak_blue, even though reduced refusals require Red approval. Both models reject daybreak_red.

Omitting the field lets the API select a compatible program based on the model and approved access. Explicit selections expose three distinct failure modes:

• 400 invalid_access_program: The selected program value is incompatible with the model.
• 400 unsupported_access_program: The model does not support the requested program.
• 403 access_program_not_enabled: Required organization approval or project enablement is missing.