OpenCode says a security breach linked to a 'distillation attack' hit 1.4% of its Console users

OpenCode, the open-source AI coding agent, said on 17 October that it had suffered a security breach "last night" related to what it called "a large scale distillation attack", affecting 1.4% of users of its OpenCode Console service. In a post on its X account, the company said it had notified all affected users by email that morning, that anyone who did not get an email was not affected, and that those affected were "a subset of users who had external providers linked". It said the incident was ongoing, so it could not share more details, and that it was working with Anthropic, OpenAI and Google to remediate. The post did not say what data was accessed or how many people the 1.4% represents.

What it means for business: teams that link their own AI provider accounts or API keys to third-party coding tools and gateways may want to review spending limits and usage on those keys, and Console users who received OpenCode's email should follow its instructions.