OpenCode Says Distillation Attack Hit 1.4% of Console Users with Linked AI Providers
Summary
OpenCode says a distillation attack breached 1.4 percent of its Console users, those who linked Anthropic, OpenAI, or Google providers. The vendor says it emailed every affected user on October 18 and has not published a root cause. Rotating the linked API keys is the recommended response.
Key Points
- OpenCode says on X it is working with Anthropic, OpenAI, and Google to remediate the breach.
- OpenCode stores linked provider credentials on a developer machine at ~/.local/share/opencode/auth.json on macOS and Linux.
- OpenCode publishes no list of affected versions, tying the breach to Console accounts rather than a CLI release.