OpenCode Reports Breach: a 'Distillation Attack' Hit 1.4% of Users

OpenCode posted a brief notice on X saying it was hit by a security incident overnight. The company describes it as a "large scale distillation attack" that affected 1.4% of OpenCode Console users.

According to the service, everyone impacted was notified by email that morning. Beyond that, the company is keeping quiet: the incident is still ongoing, the post says, so no further details can be shared yet. OpenCode adds that it is working to remediate alongside Anthropic, OpenAI, and Google.

The headline under which the story spread on Hacker News flatly states that user credentials were leaked — yet the company's own statement never mentions "keys" or "passwords," referring only to a "breach" and the aforementioned "distillation attack."

The mismatch in wording did not escape readers. One user replied under the post with a pointed question: a distillation attack that leaked keys? hmm. In an AI context, "distillation" usually means transferring knowledge from a large model into a smaller one, not stealing credentials — so the choice of words raised eyebrows.

More down-to-earth complaints showed up too: another user wrote that $138 was gone and asked whether there would be compensation. As of publication, the company had not responded under those replies.

For now OpenCode is sticking to generalities, and the picture stays incomplete: it is unclear exactly what leaked, how the "distillation" ties to the financial losses, and why three of the biggest AI model vendors are involved. A follow-up seems likely — the company promised to return with details as the situation develops.

Source: Hacker News