OpenCode says a breach tied to a distillation attack hit 1.4% of Console users with linked provider keys

OpenCode says it had a security breach on the night of October 16, tied to what it called a large-scale distillation attack, and that it affected 1.4% of OpenCode Console users. In a post on its X account at 18:08 UTC on October 17, it said the affected users were a subset who had linked external model providers, that it emailed all of them that morning, and that anyone who did not get an email was not affected.

WHAT OPENCODE SAID

The incident is still ongoing, so OpenCode said it cannot share more details yet. It said it is working with Anthropic, OpenAI and Google to fix it. OpenCode did not say how the breach and the distillation attack are connected.

WHAT USERS REPORT

Users posting on X and Reddit say OpenCode's email warns that third-party provider API keys stored in Console workspaces may have been exposed through unauthorized access to a legacy system that is being shut down. Some report charges on their provider accounts that they did not make. We have not seen the email ourselves: those details come from users, not from OpenCode's public statement.

WHAT TO DO

If you got OpenCode's email, the safe move is to revoke and reissue every provider key you linked to the Console, then check each provider's usage dashboard for requests you did not make.

WHAT WE DO NOT KNOW

How the attackers got in, how many keys were exposed, and whether Anthropic, OpenAI or Google will say anything about it.