OpenCode posted on X on October 17, 2026 (17:56 UTC, edited 12 minutes later): "We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users". The edited post adds: "If you did not get an email you were not impacted, it was a subset of users who had external providers linked", and "The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate". A Hacker News thread titled "OpenCode Hacked: User credentials leaked" reached about 790 points the same day.
What is known, and what is not
- Who is affected. OpenCode Console is the hosted side of the open-source coding agent. People who only run OpenCode locally with their own keys were not described as affected. The exposure is keys that users had linked to external providers in the hosted product.
- What leaked. The Hacker News poster quoted text they said came from OpenCode's notification email. It describes "unauthorized access to a legacy system that we were in the process of decommissioning" and tells users that third-party provider keys saved in their workspace "may have been exposed". We could not verify that email independently, but its advice -- revoke and replace the keys at each provider and review recent usage -- is right either way.
- What "distillation attack" means here. OpenCode did not explain it. The likely reading is that stolen keys were used to pull large volumes of model outputs, the raw material for training a cheaper copy, billed to the victims. OpenCode has not confirmed that.
Why stolen AI keys are now worth stealing
Help Net Security, reporting on Bitsight research on October 16, describes MONST3R-AI, sold on a restricted criminal forum as an autonomous penetration-testing platform: "The buyer pastes stolen keys into a panel, sets a budget cap and points the agent at a target list." The seller hosts no model, so "the charges go to the victim." Bitsight tracked 16 underground forums from February to August 2026. Mentions of AI agents, indirect prompt injection and MCP rose 67%. A FakeGit campaign spread malware through about 7,600 fraudulent GitHub repositories, more than 800 of them posing as AI skills or MCP servers.
What remains uncertain. OpenCode has not said how many keys were exposed in absolute terms, how long the legacy system was reachable, or whether the attackers are known. The MONST3R seller's claim of 1,072 findings across 199 hosts "comes from the seller's dashboard and Bitsight cannot verify it."
Analysis: Bring-your-own-key is now standard in coding tools, and every hosted service that stores those keys is a store of prepaid compute. Two incidents in two days show how that compute is used: to extract model outputs, or to run attacks on someone else's bill. Treat an AI provider key like a cloud root credential. Use per-tool keys with spending caps, keep them out of hosted workspaces where a local setup will do, and set provider-side usage alerts. Bitsight's advice is the right baseline: "Scan for exposed AI provider keys and treat a leak as seriously as an exposed AWS credential."
OpenCode disclosed on October 17 a breach tied to 'a large scale distillation attack' that hit 1.4% of OpenCode Console users who had external provider keys linked, and says it is working with Anthropic, OpenAI and Google; a day earlier Bitsight described MONST3R-AI, a criminal tool that runs autonomous scans on stolen AI keys so victims pay the bill.