OpenCode Discloses Distillation Attack Affecting 1.4% of Console Users

Precedent & Market Context

OpenCode has faced multiple security issues before, including problems surfacing as recently as early 2026. The latest incident adds to that track record at an awkward time for the platform.

Main Event

OpenCode made the breach public on October 17, 2026. According to the company, attackers exploited vulnerabilities in a legacy system to gain unauthorized access to API keys stored in user workspaces. Those keys were connected to models from Anthropic, OpenAI, and Google. With the keys in hand, the attackers ran repeated queries against high-end AI models. Affected users reported their account balances draining quickly, with some bills climbing into the hundreds of dollars.

Analysis & Market Impact

The incident also points to a new category of AI-specific breach. Here, the valuable thing was access to compute and model intelligence, measured in tokens and billed by the query. A stolen key to a frontier model can generate training data worth far more to a competitor than the bill it leaves behind for the victim. OpenCode's role as an aggregator is part of its appeal to developers. Linking Anthropic, OpenAI, and Google accounts in a single workspace is convenient. It also concentrates risk, which is the trade-off this breach exposed.

Implications & Outlook

For affected users, the immediate priority is containment. Anyone who connected provider accounts to the OpenCode Console should rotate or revoke those keys and review recent usage on each provider's dashboard. Billing is the open question. OpenCode's coordination with Anthropic, OpenAI, and Google suggests the companies are working on the fallout together, but the source material does not specify how charges from unauthorized queries will be handled.

• 1.4% of OpenCode Console users were affected by the distillation attack.
• The attackers exploited vulnerabilities in a legacy system to gain unauthorized access to API keys.
• Affected users reported their account balances draining quickly, with some bills climbing into the hundreds of dollars.

A photo of a person sitting at a desk with a laptop and a worried expression, with a blurred background of a cityscape to represent the global impact of the distillation attack.