OpenCode, the open-source AI coding agent, says it suffered a security breach linked to what it called a “large scale distillation attack”. The breach affected 1.4% of users of OpenCode Console, the company’s optional online service. OpenCode says the incident is still going on and that it is working with Anthropic, OpenAI and Google to fix it. It has not said what was accessed.
What OpenCode said
The company disclosed the breach in a post on 17 October, via @opencode on X. The post was published at 18:08 UTC (19:08 UK time) as an edit of an earlier version. It reads in full:
“We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate”
OpenCode has not given an absolute number of affected users. The 1.4% figure covers users of OpenCode Console only, not everyone who uses the free, open-source OpenCode agent. The company has not said what data, if any, was taken, or how the attackers got in.
About half an hour later, an OpenCode team member posted from his personal X account, @thdxr, whose profile says he is “building @opencode”. He wrote: “my personal accounts are being attacked now too”, adding: “whole new world with ai powered hacking”. He did not give details, and it is not clear whether those attempts are connected to the breach.
What OpenCode and the Console are
OpenCode describes itself on its website as “an open source agent that helps you write code in your terminal, IDE, or desktop”. It says it is used by more than 16 million developers a month. That figure is the company’s own.
The OpenCode Console is a separate, optional online service. According to OpenCode’s documentation, it offers team workspaces, access to proprietary and open-source AI models, usage tracking and budget controls. It also offers “Providers for connecting your own provider accounts through the Console gateway”.
What ‘external providers linked’ means
OpenCode says the affected users were “a subset of users who had external providers linked”. Its documentation on Console providers explains what that feature does. Teams can “connect provider accounts you already pay for, such as Anthropic, OpenAI, or AWS Bedrock”, by entering that provider’s API key. “Console stores the credential and serves each provider through its gateway, so members use the models without ever seeing the provider key,” the documentation says. Google is also in the catalogue of providers.
That explains why OpenCode is working with Anthropic, OpenAI and Google. But OpenCode has not said that any of these stored keys were exposed, and TSN is not suggesting they were. What the attackers reached remains unknown.
What a distillation attack is
Distillation means training a smaller AI model on the answers of a larger, more capable one, so that it learns to behave in a similar way. Done without permission, it becomes what AI developers call a distillation attack.
Anthropic, writing about its own defences on 12 October, describes distillation attacks as “covert, industrial-scale campaigns to extract the capabilities of one model and replicate them in another, without the authorization of the original model’s developers”. It says they “are often conducted using networks of fraudulent accounts”, and that it has seen “proxy networks that control hundreds of thousands of fraudulent accounts”. Anthropic also says distillers “distribute traffic across Anthropic’s API, third-party cloud platforms, and other inference providers”.
That is Anthropic’s general description. OpenCode has not explained how distillation relates to its breach, and none of the three AI companies has commented publicly on the incident.
What affected users should know
OpenCode says everyone affected was notified by email on the morning of 17 October, and that users who did not get an email were not affected. Beyond that, the company has given no specific advice. Users who are unsure can check for the email and watch OpenCode’s official channels for updates while the investigation continues.
What we don’t know
- What the attackers accessed or took.
- How many people the 1.4% represents.
- How the breach is linked to the distillation attack.
- What Anthropic, OpenAI and Google are doing to help fix it.
What this means
- OpenCode says a breach affected 1.4% of OpenCode Console users, all of whom had linked external AI providers. Those users were notified by email.
- The company calls it part of a “large scale distillation attack” but has shared no technical details while the incident is ongoing.
- OpenCode has not said that credentials or other data were taken. Treat early claims that go further than its statement with caution.
Sources
- OpenCode on X: breach disclosure, 17 October 2026
- @thdxr on X, 17 October 2026
- OpenCode: Console documentation
- OpenCode: Console providers documentation
- OpenCode: website
- Anthropic: Strengthening our defenses against distillation attacks
Related stories
- Anthropic Says New Defences Cut the Data “Distillers” Harvest From Claude by Around 90 to 99 Percent
- Google Says Hackers Hijacked AOMEI’s Update Servers in Five-to-Ten-Minute Bursts
- Cline v4.1.25 Adds Cloud Sessions That Keep Running After You Close the Editor
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
