# Update on the OpenCode attack: its AI helpers started refusing mid-incident

> OpenCode's Dax Raad said the AI models his team was using to investigate the attack started refusing.

Published 2026-10-18T13:25:18-07:00 · News · Canonical: https://news.littlewolflabs.com/posts/2026-10-18-opencode-attack-ai-refusals

This follows up [this morning's OpenCode Console breach story](/posts/2026-10-18-morning-digest). At 7:46 AM PT, OpenCode's Dax Raad said the AI models his team was using to investigate the ongoing attack "did quite a bit and then started refusing." He said things got better once they got access to OpenAI's Daybreak Blue. That's OpenAI's approved-access program for verified defensive security work. It cuts refusals on mainline models like GPT-6 Sol, and you have to apply and be approved to get it. Dax didn't say which models refused.

## What this means for you

If you use AI for security or incident response, the normal safeguards can kick in right when you need help most. If your team might need it, apply for trusted access before an incident, not during one.

## Sources

- [Dax on X](https://x.com/thdxr/status/2111831348336091179)
- [OpenAI Daybreak overview](https://help.openai.com/en/articles/20001258-openai-daybreak-trusted-access-for-cyber-overview)
- [Andrew Curran's summary](https://x.com/AndrewCurran_/status/2111837963214794940)