OpenCode says it had a security breach "related to a large scale distillation attack" that affected 1.4% of OpenCode Console users. The company says it emailed every affected user. If you did not get an email, it says, you were not impacted.

What OpenCode has said

The post is dated Oct. 17 and was last edited at 6:08 PM that day. As of 4:20 PM ET Oct. 19, that post, its status page, its changelog and its home page show no later update.

  • Who was affected: a subset of Console users who had external providers linked, 1.4% of Console users.
  • How they were told: by email, the morning after the breach.
  • Status: OpenCode calls the incident ongoing and says it cannot share more yet.
  • Who it is working with: Anthropic, OpenAI and Google, to remediate.

OpenCode has not said what was accessed, how the attack worked or who was behind it. Its status page, as of the same time, listed degraded performance on one pay-as-you-go model and no breach notice.

What to do

This section is our guidance, not OpenCode's statement. OpenCode has said nothing about keys. Start with your inbox, including spam, for a message from OpenCode.

  • Got the email: follow its instructions. If you linked provider keys, consider revoking or rotating them at each provider's own dashboard.
  • No email: OpenCode says you were not affected. If you linked provider keys, rotating them is still cheap.
  • Everyone: if you linked providers, check each provider's usage page for calls you do not recognize, and set a spending limit where one is offered.

Why it matters

OpenCode is an open-source coding agent, and it said the affected users had external providers linked. Our explanation: linking a paid AI provider usually means handing the tool an API key. If a key were exposed, whoever held it could make calls billed to the key's owner. OpenCode has not said any keys were taken.

Our explanation of the term: a distillation attack means querying an AI model at scale to train a copy of it.

For a related AI security story, see AI agents broke into 100+ sites, and browse more in AI and apps.