OpenCode's 'Distillation Attack' Drained Users' AI Keys
OpenCode called it a "large scale distillation attack." The developers staring at four-figure API bills on Saturday morning have a simpler word for it: stolen. When the company behind the open-source coding agent finally spoke up on 17 October, it admitted attackers had walked out of its systems with the keys to the kingdom — the Anthropic, OpenAI and Google API keys its users had entrusted to its hosted Console product. The breach hit 1.4% of Console users. What OpenCode has not said, two days later, is how many people that actually is.
Here's the detail that should make every developer wince: the way in wasn't some exotic zero-day. According to the customer email the company sent, attackers got "unauthorized access to a legacy system that we were in the process of decommissioning." A server slated for the scrapheap, still reachable, still holding production credentials. That's not a sophisticated adversary story. That's a housekeeping story.
What OpenCode actually told its users
There were two statements, and the gap between them tells you everything about how this weekend went. First came the email, subject line "Action Required: Potential provider key breach," which landed on Saturday morning. Its core sentence: "We identified unauthorized access to a legacy system that we were in the process of decommissioning. Third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed." Recipients were told to revoke and replace their keys through each provider's dashboard and review recent usage for anything unexpected.
The public statement arrived hours later, on the project's X account, and it added the scale and the spin: "We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users," it read. "We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked." The company added that the incident was ongoing, that it couldn't share more detail, and that it was working with Anthropic, OpenAI and Google to remediate.
We pulled the public post and the email text ourselves and walked them line by line against the secondary reporting. The two accounts agree on the essentials — and both, notably, stop well short of saying the keys were used. "May have been exposed" is doing a lot of heavy lifting in that email.
The bills arrived before the warning
Before OpenCode said a word publicly, the damage was already itemised — by the victims, in public. Security researcher Matt Johansen, who runs the newsletter Vulnerable U, was fielding DMs from users whose keys were "running up charges" by Saturday morning. At 15:30 UTC he posted the line that broke the story open: "Confirmed. OpenCode hacked. Keys stolen."
Then came the receipts. Colin Parsons wrote on X at 9:36 a.m. ET — before OpenCode's public statement — that his OpenAI key had been "pounded" for $281 of usage starting at 2 a.m. that morning, and his Anthropic key for $168. Both keys, he said, were used only in OpenCode. Preston Zeller put his losses at $1,700. Francisco Giancarelli said he watched "over 700 in openai usage before I pulled the plug." Alejandro GarcÃa Iglesias reported stolen OpenAI and Anthropic credits — and an OpenAI account suspended on top. A Notebookcheck roundup of Reddit reports added a user with roughly $400 in unauthorised Anthropic charges and another with about €200 in Google usage whose project was suspended for abuse.
A word of honesty here: these are social-media claims, and The Latent — which did the best reporting on the story — explicitly says it could not independently verify them. Treat the numbers as direction, not audit. But the pattern is unmistakable, and the developer thread on Hacker News, which climbed past 850 points within a day according to one developer roundup, suggests this was no isolated incident.
A funny name for an old crime
Let's talk about the phrase doing the strangest work in this story: "distillation attack." In AI circles, distillation means training a cheaper model on the outputs of a frontier one — harvesting billions of input-output pairs to clone capability on the cheap. It's a real and growing threat; US agencies in September accused six Chinese firms, including DeepSeek and Moonshot AI, of extracting billions of tokens from American models, and OpenAI said it shut down a Moonshot-linked campaign extracting reasoning traces in July.
But here's the thing: what happened at OpenCode looks, on the available evidence, like plain credential theft. Somebody grabbed API keys and ran queries against expensive models on somebody else's dime. Calling that a "distillation attack" is technically defensible — if the attacker's end goal was harvesting outputs at scale — but OpenCode has offered zero evidence of that motive. It hasn't said what the attackers queried, how much they burned, or why it believes distillation rather than simple cryptomining-style compute theft is the explanation. As one roundup acidly noted, 1.4% is a percentage with no denominator: no user count, no key count, no loss figure, no attacker identified.
Maybe the distillation framing is accurate. Or maybe "distillation attack" sounds better in a disclosure than "we left the keys in a server we forgot to turn off." Until OpenCode publishes a real post-mortem, we get to wonder.
Your API key is a credential now — treat it like one
The deeper lesson here isn't about OpenCode's housekeeping, though that was clearly shoddy. It's about what an AI coding tool actually is, security-wise. OpenCode's Console is marketed as a convenience: link your provider accounts and your team "uses the models without ever seeing the provider key." But a system that holds your keys and spends your money on your behalf is a credential store whether it's marketed as one or not — and it needs to be hardened like one, with the monitoring, alerting and blast-radius controls that implies.
Consider the economics. An API key is no longer a password to a service; it's a direct line to someone else's credit card, denominated in tokens. An attacker with a stolen Anthropic key doesn't need to exfiltrate anything. They just point the key at the most expensive model available and let it rip. Budgets and alerts exist — Anthropic, Google AI Studio and Groq all document monthly spend caps, and OpenAI has an enforceable project budget — but they are opt-in, and most developers never set them. The victims in this story learned that the expensive way.
One important boundary, because the panic is already spreading further than the facts: this appears to be a Console-only problem. OpenCode co-founder Dax Raad has said that keys used in the regular OpenCode app never reach the company — only keys saved in Console workspaces were exposed. Your ~/.local/share/opencode/auth.json on your own machine is not implicated in anything disclosed so far. If you never linked a provider key through the Console web product, the company's line is that you weren't hit — "if you did not get an email you were not impacted."
And in the middle of all this, Raad posted the most human line of the weekend: that his own personal accounts were "being attacked now too," adding, "whole new world with ai powered hacking." When the co-founder is getting hit, the "isolated incident" framing gets harder to sustain.
What to do if you ever touched Console
Don't wait for an email. If you ever saved a provider key in an OpenCode workspace, rotate it today: create a replacement key in the provider's dashboard first, deploy it wherever you use it, then delete the old one, and watch usage for 48 hours. Check billing logs back to at least 16 October. Set a hard monthly cap on every provider that offers one — this is the single cheapest insurance in the AI economy, and almost nobody bothers until something like this happens. And grep your shell history, .env files and CI secrets for keys you forgot you pasted somewhere; the breach may be the prompt, but the hygiene was overdue anyway.
It's also worth watching what the providers do. According to one roundup, Anthropic has already revoked Claude API keys it believed were affected — if your Claude key suddenly dies, that's probably why, and it's actually the system working. Expect OpenAI and Google to follow with their own quiet cleanups.
The questions OpenCode still won't answer
Two days in, the incident is "ongoing" and the company "cannot share more details." Fine — investigations take time. But some things don't require an investigation. How many Console users are there, so 1.4% means something? Were the keys merely exposed or actively used, and how much was burned? Will victims be reimbursed for charges they didn't run up? Why did a system "in the process of being decommissioned" still have network access to production credentials at all?
And then there's the status page. At 19:00 UTC on 17 October — hours after the disclosure — one security writer noted OpenCode's status page showed no security incident whatsoever. Customers learned about a credential breach from an email and a Reddit thread, not from the page whose entire job is telling customers what's broken. That's a small thing, but small things are how you tell whether a company has internalised the lesson or just hired a crisis comms consultant.
Here's our position, stated plainly: OpenCode built a beloved tool — 215,000 GitHub stars don't happen by accident — and then stored the keys to its users' wallets on a server it was supposed to have retired. The "distillation attack" framing may yet prove accurate, but right now it reads as narrative laundering for a botched decommission. Developers will forgive a breach faster than they'll forgive evasiveness. The clock on the post-mortem is ticking.
This is part of a pattern worth watching: as AI policy hardens — Washington just ended the era of AI self-regulation — the gap between what AI companies promise about safety and how they handle the boring parts of security keeps showing. And as Anthropic's own deal-making gets lawyered to within an inch of its life, the industry's risk appetite is clearly being repriced everywhere at once.
Sources
OpenCode's public statement on X (17 Oct 2026) and the customer email ("Action Required: Potential provider key breach"), as reproduced by The Latent, FourWeekMBA, OfficeChai and dev.to roundups; Matt Johansen and Dax Raad on X; user loss reports on X and Reddit via The Latent and Notebookcheck (unverified); background on distillation campaigns from The Latent. We read the primary statements directly and cross-checked the figures across the secondary reports; anything we couldn't corroborate is hedged or dropped above.
TechPulse USA Newsroom covers the AI industry's collisions with security, policy and money — the stories where the press release and the incident report disagree. We verify every fact we print against primary sources; when we can't, we say so.
Comments
Post a Comment