OPENCODE has disclosed a security breach tied to a large-scale AI distillation attack that affected 1.4 per cent of OpenCode Console users. The company announced the incident on 17 October 2026 and said its investigation is ongoing. The breach centres on stored credentials used to call third-party AI models; specifically, keys saved in a shared Console workspace were exposed after unauthorised access to a legacy system that the firm was retiring.
OpenCode notes that users who had connected external model providers were the ones affected, while others who did not receive a notice were reportedly not harmed.
The company links the incident to an AI distillation tactic, whereby attackers harvest large volumes of responses from an existing model and use that data to train a new one that imitates some of the original model’s capabilities. OpenCode has not yet explained how the intruders gained entry, what data was exfiltrated, or how the leak specifically connects to the distillation process. In response, Anthropic, OpenAI and Google are assisting with the cleanup.
OpenCode asserts it has notified every user it deems affected; those who did not receive email were not reported harmed. For those who did receive a notice, the recommended immediate steps are to revoke compromised keys in each provider’s dashboard, generate new keys, and review API usage and spending for unfamiliar activity. As of 19 October 2026, public details about the intrusion’s root cause and full scope remain limited.