Cyber defenders raced to counter an active breach. Mid-investigation, their frontier AI models suddenly refused to inspect the hacker code.

OpenCode suffered a massive distillation attack over 48 hours. Hackers compromised API keys for OpenAI, Anthropic, and Google services.

The exploit hit 1.4% of OpenCode Console users. Major AI providers rushed to revoke compromised keys and wipe unauthorized API charges.

Frontier models analyzed the assault early on. But as code analysis intensified, built-in safety filters flagged the malware and shut defenders out.

Commercial AI cannot distinguish between a malicious hacker and an authorized engineer dissecting exploits to save a corporate network.

Co-creator Dax Raad confirmed the models refused requests. Responders survived only after OpenAI granted access to its Daybreak Blue program.

Should frontier AI providers disable malware safety filters for verified cybersecurity investigators?

Teams are turning to self-hosted open-weight models. Unrestricted local instances ensure investigations never stall during live security threats.

A shield that drops when struck is no shield. Read the complete investigation into the battle between safety filters and cyber defense.