OpenCode Console Breached in Distillation Attack: Third-Party API Keys Compromised

The Three-Question Framework

What Happened?

Anomaly disclosed an active security breach affecting OpenCode Console, confirming that an adversary executed a large-scale distillation attack that compromised external API credentials for 1.4% of users who had linked third-party model providers.

Why It Matters

The incident reveals acute systemic vulnerabilities in proxy-based developer tooling, where centralized credential storage allows attackers to drain linked enterprise API keys to fund high-throughput synthetic model training.

What Could Happen Next

OpenCode is coordinating incident remediation with Anthropic, OpenAI, and Google while affected developers rotate compromised API keys and audit billing statements for unauthorized token consumption.

Executive Key Takeaways

The breach specifically targeted OpenCode Console, impacting approximately 1.4% of users with linked external model provider credentials.

Attackers weaponized stolen API keys in a high-volume distillation attack to generate synthetic training tokens across OpenAI, Anthropic, and Google models.

OpenCode confirmed the local CLI coding agent, local background daemon, and desktop applications were completely unaffected by the server-side breach.

AI researchers noted the absence of standardized provider revocation APIs, forcing affected users to manually invalidate keys across individual provider portals.

In a public security incident disclosure published on October 17, 2026, the maintainers of OpenCode announced that an unauthorized intrusion compromised the OpenCode Console service. The breach enabled threat actors to extract third-party foundation model API keys stored on the platform, affecting approximately 1.4% of registered Console users who had linked external accounts.

The incident occurred less than 48 hours after the public launch of OpenCode 2.0. According to official disclosures, the attackers leveraged the exfiltrated API keys to mount a massive model distillation attack, routing automated high-throughput prompts through legitimate developer accounts to harvest synthetic training data from leading proprietary models, including Anthropic Claude and OpenAI GPT systems.

Community discussions on Hacker News emphasized that OpenCode Console operates as a centralized API proxy and billing aggregator, distinct from OpenCode's open-source terminal coding agent. Maintainers confirmed that users operating the standalone CLI agent or local MCP tool harnesses without linked Console proxy accounts were entirely insulated from the breach.

The attack underscores growing enterprise concern regarding token theft for illicit model distillation. AI researcher Nathan Lambert pointed out that unauthorized distillation pipelines represent a critical emerging threat vector, as adversaries weaponize breached API quotas to circumvent frontier labs' terms of service and avoid compute costs during model training. Affected developers reported unauthorized billing charges accumulating within hours of the intrusion.

OpenCode stated that direct email notifications were dispatched to all impacted account holders on the morning of October 17. The company is actively collaborating with security teams at Anthropic, OpenAI, and Google to identify unauthorized token streams and block malicious IP infrastructure. The full technical post-mortem regarding the exact vector used to compromise the Console database remains pending.

The Three-Question Framework

What Happened?

Why It Matters

What Could Happen Next

Executive Key Takeaways

Primary Sources & Citations