OpenCode discloses distillation attack that hit 1.4% of Console users

OpenCode discloses distillation attack that hit 1.4% of Console users

Attackers exploited a legacy system to hijack stored API keys for Anthropic, OpenAI, and Google models, leaving some users with bills in the hundreds of dollars.

By Diego Almada Lopez | Oct. 17, 2026

OpenCode, the open-source AI coding platform, has disclosed a large-scale security breach tied to what it calls a distillation attack. The incident affected about 1.4% of its Console users who had linked external AI provider accounts. The attackers were not after passwords or credit card numbers. They wanted access to some of the most expensive AI models on the market, and they found a way to make OpenCode users pay for it.

What happened inside OpenCode's Console

OpenCode made the breach public on October 17, 2026. According to the company, attackers exploited vulnerabilities in a legacy system to gain unauthorized access to API keys stored in user workspaces. Those keys were connected to models from Anthropic, OpenAI, and Google. With the keys in hand, the attackers ran repeated queries against high-end AI models. Affected users reported their account balances draining quickly, with some bills climbing into the hundreds of dollars.

OpenCode says it is working with Anthropic, OpenAI, and Google on remediation. The company is advising users to secure their credentials by rotating or revoking their API keys.

Why attackers want model outputs

The term "distillation" describes a technique where one AI model learns by studying the answers of another. In this case, the attack appears designed to harvest high-quality responses from top-tier models. Those outputs can then be used to train competing models, without the attacker paying for the compute or the original research. That makes this breach different from a typical data leak. The stolen asset was not stored user information. It was the ability to make large volumes of queries to frontier models on someone else's dime.

This is not the first time the tactic has drawn attention. Anthropic detailed similar distillation methods used by others back in February 2026. OpenCode's coding agent has also faced multiple security issues before, with problems surfacing as recently as early 2026. The latest incident adds to that track record at an awkward time for the platform.

Why OpenCode made an attractive target

Major AI labs have been tightening direct access to their most capable models. A tool that stores keys for several providers in one place offers several side entrances at once. OpenCode's role as an aggregator is part of its appeal to developers. Linking Anthropic, OpenAI, and Google accounts in a single workspace is convenient. It