What OpenCode said
OpenCode, the open-source terminal coding agent built by the team behind SST, disclosed a breach in a post on X on 17 October. The statement is four sentences long and is the company’s only public account so far.
“We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users,” it reads. “We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked. The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate.”
That last clause is the shape of the problem. OpenCode Console lets a user link their own accounts at model providers, which means the platform holds credentials that belong to someone else’s service. The breach is not of OpenCode’s model; it is of the keys its users pointed at other people’s models.
Why “distillation attack” is the right name
The phrase describes what a stolen provider key is worth. It is not primarily a route to data — it is the ability to send a very large volume of queries to a frontier model on someone else’s account, which is how a distillation run against a commercial model is paid for. The victim’s first signal is a bill.
In a write-up published the same day, the security firm Cyera said OpenCode’s notification email attributed the intrusion to a legacy console system the company was in the process of retiring, and that the exposed credentials were provider keys linked in affected Console workspaces. Cyera’s remediation guidance also names OpenRouter alongside the three providers OpenCode listed.
What has not been said
Four things are missing from the disclosure, and all of them matter to anyone trying to work out their own exposure.
First, the denominator. 1.4% of Console users is a ratio, not a count, and OpenCode has not published the total. Second, the entry point: the company has said which system was involved but not how the attacker reached it, or how the keys were stored once there. Third, whether any exposed key was actually used — OpenCode has not confirmed misuse, and the incident was described as ongoing. Fourth, attribution: nobody has publicly named who did this.
What affected users were told to do
The advice is the standard credential-rotation drill, with one wrinkle specific to this class of incident. Revoke and reissue every provider key linked in an affected workspace, through each provider’s own dashboard rather than through OpenCode or a link in an email. Update the tools and pipelines that use those keys and confirm the old ones are dead. Reset the OpenCode account password and regenerate any OpenCode Console API keys.
The wrinkle is the billing review. Cyera’s guidance is to check provider usage and billing from 16 October onward for spikes, unfamiliar models, or activity at odd hours — because with a distillation attack the damage shows up as consumption rather than as a missing record. Setting hard spend limits and scoping keys per project are the controls that cap it.
Keys used directly from the local OpenCode application are stored on the user’s own machine rather than in Console, which puts them outside this incident.
What to watch
OpenCode has promised more detail once the incident closes. The useful parts of that report are the two it has withheld: the access path, and whether the keys were used. The second question is the one that tells the rest of the industry whether a developer tool holding provider credentials is a soft target worth attacking at scale, or whether this was opportunistic.
