OpenAI's Tibo says OpenAI worked with OpenCode to restore affected users and refund API credits drawn in the attack
Our team worked with OpenCode to have their users who are also OpenAI API customers back in business and any credits refunded which would have been drawn in the attack. Also, you can request Daybreak Blue access to use our cyber permissive setup for defense. Do not wait until you have to deal with an incident. We’re here to help.
Context
Developers whose OpenAI keys were exposed through a third party tool may get their money back, and OpenAI is steering defenders toward its less restrictive cyber tier.
Tibo leads Codex at OpenAI, and this is a first hand statement from him. OpenCode, an open source coding agent, disclosed a breach tied to a distillation attack on October 17, and its founder dax said attackers kept hitting its systems for the next two days.
Deep dive
Shortly after midnight on October 19, Tibo posted that his team worked with OpenCode to get its users who are also OpenAI API customers back in business, and to refund any credits that would have been drawn in the attack.
He added that people can request Daybreak Blue access to use OpenAI's cyber permissive setup for defense, and told them not to wait until they have to deal with an incident. We're here to help, he wrote.
OpenCode said on October 17 that a breach tied to a large scale distillation attack affected 1.4% of OpenCode Console users who had linked external model providers. Tibo's post indicates the attack drew on some of those users' OpenAI API credits. The next day, dax said OpenCode had faced attacks for 48 hours, that AI models had refused to help at points during the investigation, and that OpenCode had since been approved for Daybreak Blue.
OpenAI's help center describes Daybreak Blue as an approved tier of its Trusted Access for Cyber program that reduces refusals on supported models for verified defensive work, such as incident response and malware analysis, while other safeguards still apply.
Tibo did not say how many users or how much money the refunds cover, or how affected customers are identified.
What to expect next
Watch for a full incident report from OpenCode, which has not said exactly what was taken, and for whether other model providers announce similar refunds.
Also watch whether more small developer tools apply for Daybreak Blue after this incident, and whether OpenAI makes the tier easier to get. The case is an early test of how AI companies support third party tools whose users' keys are abused.