--- title: OpenCode reports breach tied to distillation attack... description: OpenCode disclosed a security breach affecting 1.4% of its Console users, linked to a large-scale distillation attack that reportedly drained some users'... canonical: https://daily.dev/posts/opencode-reports-breach-tied-to-distillation-attack-affecting-1-4-of-console-users-cuixmnfyh twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: OpenCode reports breach tied to distillation attack affecting 1.4% of Console users | daily.dev og:description: OpenCode disclosed a security breach affecting 1.4% of its Console users, linked to a large-scale distillation attack that reportedly drained some users'... og:url: https://daily.dev/posts/opencode-reports-breach-tied-to-distillation-attack-affecting-1-4-of-console-users-cuixmnfyh og:image: https://api.daily.dev/og/posts/cUiXmnFYh.png og:image:alt: OpenCode reports breach tied to distillation attack affecting 1.4% of Console users og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # OpenCode reports breach tied to distillation attack affecting 1.4% of Console users **[Collections](https://daily.dev/sources/collections)** · 3 min read · 2 upvotes · 1 comments ## Summary OpenCode disclosed a security breach affecting 1.4% of its Console users, linked to a large-scale distillation attack that reportedly drained some users' OpenAI, Anthropic, and Google API balances. The incident is still ongoing, with OpenCode withholding further details while working with the three AI labs to resolve it. Early commentary suggests the attack may indicate stronger protections at major AI labs and increased value of their tokens for distillation, while raising concerns about the safety of smaller API providers that many developers route through unknowingly. ## Content OpenCode disclosed a security breach on October 17 that affected 1.4% of its Console users. The company tied it to what it called a large-scale distillation attack. Third-party API keys saved in affected workspaces may have been exposed, and some users say their balances were drained. ## What OpenCode has said In its statement, OpenCode said the breach happened the night before. It emailed every affected user that morning, and anyone who didn't get an email wasn't affected. The 1.4% figure covers Console users who had linked external providers, not the whole OpenCode user base. The incident was still ongoing when the company posted, so it declined to share more. It said it was working with Anthropic, OpenAI and Google to fix things. Some accounts say the attackers got in through a legacy system that was being decommissioned. They also say the keys exposed were for OpenAI, Anthropic and Google. ## What users are reporting Affected developers say they saw model requests they never made. Some report unauthorized charges between $400 and $1,700 before any warning reached them. ## The open question Distillation may explain what the attackers wanted. It doesn't explain how they got in, and OpenCode hasn't disclosed the initial attack vector or exactly what data was exposed. A stolen key is a bearer credential. Whoever holds it can send requests to OpenAI, Anthropic or Google, and the owner pays. That's the broader problem here: keys sit in editors, CLIs, coding agents and side projects, and each one is another place for them to leak. ## Provider response - Anthropic revoked the Claude API keys it believes were affected. Anthropic's @lydiahallie said anyone who saved a key in OpenCode should create a new one to be safe. - OpenAI said it worked with OpenCode to get users who are also OpenAI API customers back in business, and to refund any credits drawn in the attack. It also pointed to Daybreak Blue access, its cyber-permissive setup for defense. ## What to do 1. Check for the notification email from OpenCode. 2. Rotate any provider key you linked in OpenCode, whether or not you got the email. 3. Review usage and billing at each provider for requests you didn't make. 4. Set hard spend limits on every provider account. 5. Inspect the local auth.json file to see which providers are linked. StepSecurity's Dev Machine Guard, or its open source scanner, can find OpenCode installs across developer machines. One commentator, @testingcatalog, argued that if distillation is now the easiest attack to run, the big labs are better protected than before and smaller providers are less safe. That's speculation, but it's a reasonable worry. Either way, scattering raw keys across tools is a habit worth breaking. ## Questions this post answers ### What happened in the OpenCode Console security breach? OpenCode disclosed a breach tied to a large-scale distillation attack that affected 1.4% of Console users, with some users' OpenAI, Anthropic, and Google balances drained. OpenCode emailed affected users and is working with all three AI labs to resolve the still-ongoing incident before sharing further details. _Developers relying on AI coding tools can follow breach updates like this one on daily.dev._ ### Why would attackers target API balances for a distillation attack? Tokens from leading AI labs appear to carry more value for distillation now, since direct access is harder to obtain, making compromised accounts an attractive way to extract usable training signal from frontier models. This also implies smaller API providers may offer weaker protections than major labs, making them comparatively riskier routes for developers. _Teams weighing which AI providers to trust can track incidents like this via daily.dev._ ## Community take How the wider developer community reacted, aggregated from 2 discussions and 273 comments across hackernews, x (as of 2026-10-19). **TL;DR:** Reaction to the OpenCode breach disclosure is mixed: some commenters praise the fast refund and remediation, while others question the unclear attack vector, criticize requiring hardware security keys for advanced access tiers, and vent about unrelated product frustrations. We had a security breach last night related to a large scale distillation attack that impacted 1.4%...: Commenters largely view this as a poorly-communicated disclosure of a leaked-API-key incident on OpenCode Console (a hosted BYOK/OpenRouter-like service), distinct from the OpenCode CLI, with many questioning the company's transparency and trustworthiness; there's also a tangential meta-debate about the post's own ranking/flagging on the discussion platform. **Sentiment:** 13% positive · 32% mixed · 55% skeptical **The case for** - Several people praised OpenAI and OpenCode for refunding drained credits and restoring access quickly. - Some note the breach is narrowly scoped to OpenCode Console/Zen BYOK users and doesn't affect the open-source CLI binary. - Some called the incident response a model example of handling a breach transparently. - A few defend the team, saying the free title-gen fallback model feature was benign and since removed, not a data-harvesting scheme. **The pushback** - Multiple commenters pointed out the actual attack vector (whether keys were lifted from configs or drawn via integration) was never clarified. - Many feel the disclosure was vague and confusing, conflating 'OpenCode' (CLI) with 'OpenCode Console' and withholding technical details. - Some argued requiring physical FIDO2 hardware keys for elevated security tiers is overly burdensone and inaccessible for solo developers. - Several recall past warning signs about OpenCode's data practices (undisclosed third-party processors, prompts routed through other providers) that went unaddressed. - A few felt it's unfair that subscription users unaffected by the API breach are asking for unrelated compensation. **By community** - hackernews (heated): Discussion splits between genuine anger over leaked API keys and shaky company communication, and a side argument over whether the post itself was being unfairly downranked/flagged. - x (mixed): Replies swing between appreciation for the refund/remediation process and frustration over unanswered questions on the attack vector plus unrelated gripes about hardware security key requirements and product performance. **Hottest debate:** Whether requiring physical hardware security keys (like YubiKeys) for higher security/access tiers is a reasonable safeguard or an unreasonable barrier for individual developers. **Open questions** - What was the precise attack vector — were keys pulled from OpenCode configs or drawn through the tool's integration? - How exactly were the stored API keys exposed from the 'legacy system' being decommissioned? - How much data was actually distilled/exfiltrated during the attack? - Why is this being called a 'distillation attack' rather than simply a key leak used for resale/misuse? - Will there be a clear way for users to check if their own account was affected? **Highlights** > @thsottiaux It's the OpenCode breach from the weekend. A distillation attack hit 1.4% of its Console users, the ones who'd linked outside providers, and the queries ran on their own saved API keys. So the drained credits came out of OpenAI accounts, not OpenCode's, which is why the refund > — [buzz\_voice on x · 1 points](https://x.com/buzz_voice/status/2112155605649457492) > @thsottiaux Refunding the drawn credits is the right call. Curious how Daybreak Blue access works in practice though. If teams have to apply before an incident, most small ones will only find out mid attack. > — [dezign\_ash on x · 1 points](https://x.com/dezign_ash/status/2112082304378302808) > @thsottiaux The question nobody's answering: what was the actual attack vector — were API keys lifted from OpenCode configs, or was usage drawn through the tool's integration? That distinction decides whether this is contained or a pattern every agent tool is exposed to. > — [haristiks on x · 1 points](https://x.com/haristiks/status/2112082468971151650) > @thsottiaux this is how you handle an incident. users back in business, credits refunded, no excuses. everyone take notes > — [avynsrc on x · 1 points](https://x.com/avynsrc/status/2112149240394977569) > @thsottiaux Refunding the credits before anyone has to argue with support is top-tier incident response. But the real takeaway sits with us on the consumer side: spend caps, per-key limits and rotation should be default posture, not post-incident homework. > — [mrshorifuddin on x](https://x.com/mrshorifuddin/status/2112103449596657808) **Source threads** - [x](https://x.com/thsottiaux/status/2112034063934742720) · 3 points · 161 comments - [hackernews](https://news.ycombinator.com/item?id=50133401) · 652 points · 112 comments - [x](https://x.com/charliermarsh/status/2112139641109311695) · 0 points · 0 comments ## Community discussion Top comments from developers on daily.dev. **@petermrozek** · 0 upvotes > AI-generated software having security issues - what a shocker. 😱 "Hurr durr... but it's a lot better than a year ago..." - really now? > > Don't forget folks - labs are where you do experiments, not products. 😉 --- Tags: [#openai](https://daily.dev/tags/openai), [#anthropic](https://daily.dev/tags/anthropic), [#opencode](https://daily.dev/tags/opencode) [View this post on daily.dev](https://daily.dev/posts/opencode-reports-breach-tied-to-distillation-attack-affecting-1-4-of-console-users-cuixmnfyh) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"OpenCode reports breach tied to distillation attack affecting 1.4% of Console users","url":"https://daily.dev/posts/opencode-reports-breach-tied-to-distillation-attack-affecting-1-4-of-console-users-cuixmnfyh","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/opencode-reports-breach-tied-to-distillation-attack-affecting-1-4-of-console-users-cuixmnfyh"},"datePublished":"2026-10-17T19:16:02.963Z","dateModified":"2026-10-19T14:12:55.748Z","description":"OpenCode disclosed a security breach affecting 1.4% of its Console users, linked to a large-scale distillation attack that reportedly drained some users'...","image":"https://pbs.twimg.com/media/HU2vWZiXsAAVwcS.jpg","thumbnailUrl":"https://pbs.twimg.com/media/HU2vWZiXsAAVwcS.jpg","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/opencode-reports-breach-tied-to-distillation-attack-affecting-1-4-of-console-users-cuixmnfyh","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"openai,anthropic,opencode","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"OpenCode reports breach tied to distillation attack affecting 1.4% of Console users"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/opencode-reports-breach-tied-to-distillation-attack-affecting-1-4-of-console-users-cuixmnfyh","comment":[{"@type":"Comment","text":"AI-generated software having security issues - what a shocker. 😱 “Hurr durr… but it’s a lot better than a year ago…” - really now?\nDon’t forget folks - labs are where you do experiments, not products. 😉","datePublished":"2026-10-18T09:25:12.164Z","url":"https://daily.dev/posts/cUiXmnFYh#c-Af9t08ZMU","author":{"@type":"Person","name":"Peter Mrożek","url":"https://daily.dev/petermrozek","image":"https://media.daily.dev/image/upload/s--pBfYX68K--/f_auto/v1769247960/avatars/avatar_Qz65P1nVw3Bu6C5YwaZgA?_a=BAMAMiiu0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/opencode-reports-breach-tied-to-distillation-attack-affecting-1-4-of-console-users-cuixmnfyh#faq","mainEntity":[{"@type":"Question","name":"What happened in the OpenCode Console security breach?","acceptedAnswer":{"@type":"Answer","text":"OpenCode disclosed a breach tied to a large-scale distillation attack that affected 1.4% of Console users, with some users' OpenAI, Anthropic, and Google balances drained. OpenCode emailed affected users and is working with all three AI labs to resolve the still-ongoing incident before sharing further details. Developers relying on AI coding tools can follow breach updates like this one on daily.dev."}},{"@type":"Question","name":"Why would attackers target API balances for a distillation attack?","acceptedAnswer":{"@type":"Answer","text":"Tokens from leading AI labs appear to carry more value for distillation now, since direct access is harder to obtain, making compromised accounts an attractive way to extract usable training signal from frontier models. This also implies smaller API providers may offer weaker protections than major labs, making them comparatively riskier routes for developers. Teams weighing which AI providers to trust can track incidents like this via daily.dev."}}]} ```