OpenCode discloses distillation attack that hit 1.4% of Console users

OpenCode, the open-source AI coding platform, has disclosed a large-scale security breach tied to what it calls a distillation attack. The incident affected about 1.4% of its Console users who had linked external AI provider accounts.

The attackers were not after passwords or credit card numbers. They wanted access to some of the most expensive AI models on the market, and they found a way to make OpenCode users pay for it.

What happened inside OpenCode’s Console

OpenCode made the breach public on October 17, 2026. According to the company, attackers exploited vulnerabilities in a legacy system to gain unauthorized access to API keys stored in user workspaces.

Those keys were connected to models from Anthropic, OpenAI, and Google. With the keys in hand, the attackers ran repeated queries against high-end AI models. Affected users reported their account balances draining quickly, with some bills climbing into the hundreds of dollars.

OpenCode says it is working with Anthropic, OpenAI, and Google on remediation. The company is advising users to secure their credentials by rotating or revoking their API keys.

Why attackers want model outputs

The term “distillation” describes a technique where one AI model learns by studying the answers of another. In this case, the attack appears designed to harvest high-quality responses from top-tier models. Those outputs can then be used to train competing models, without the attacker paying for the compute or the original research.

That makes this breach different from a typical data leak. The stolen asset was not stored user information. It was the ability to make large volumes of queries to frontier models on someone else’s dime.

This is not the first time the tactic has drawn attention. Anthropic detailed similar distillation methods used by others back in February 2026.

OpenCode’s coding agent has also faced multiple security issues before, with problems surfacing as recently as early 2026. The latest incident adds to that track record at an awkward time for the platform.

Why OpenCode made an attractive target

Major AI labs have been tightening direct access to their most capable models. A tool that stores keys for several providers in one place offers several side entrances at once.

OpenCode’s role as an aggregator is part of its appeal to developers. Linking Anthropic, OpenAI, and Google accounts in a single workspace is convenient. It also concentrates risk, which is the trade-off this breach exposed.

What this means for developers and AI platforms

For affected users, the immediate priority is containment. Anyone who connected provider accounts to the OpenCode Console should rotate or revoke those keys and review recent usage on each provider’s dashboard.

Billing is the open question. OpenCode’s coordination with Anthropic, OpenAI, and Google suggests the companies are working on the fallout together, but the source material does not specify how charges from unauthorized queries will be handled.

The incident also points to a new category of AI-specific breach. Here, the valuable thing was access to compute and model intelligence, measured in tokens and billed by the query. A stolen key to a frontier model can generate training data worth far more to a competitor than the bill it leaves behind for the victim.

Anthropic’s February 2026 disclosure suggests the labs are already watching for distillation behavior closely. Restricting direct access is one defense, but this breach shows its limits. When the front door locks, the pressure moves to every intermediary holding a key.

For OpenCode, the path forward depends on how thoroughly it addresses the legacy vulnerability and how it treats users who were left with surprise bills. With prior security issues already on the record, the platform’s response will be judged against a higher bar than a first-time stumble would face.