OpenCode disclosed a security incident on October 17, 2026 through its official account: on the evening of October 16, its platform suffered a security breach related to a large-scale distillation attack, affecting 1.4% of OpenCode Console users. The company said it had notified all affected users by email on the morning of October 17 and is working with Anthropic, OpenAI and Google to remediate; the incident is still being handled, and no further details are available for now.
Only three facts have been confirmed
Read closely, the disclosure is deliberately restrained. First, the incident is characterised as tied to a large-scale distillation attack, not an ordinary data leak or outage. Second, the scope is quantified: 1.4% of Console users. Console is OpenCode's hosted service through which users access models, and this group of users calls models from several providers through a single entry point. Third, notification and remediation are already under way: affected users have received email, and three upstream model providers are involved. How the attackers got in, and whether the impact took the form of hijacked accounts, drained quotas or read data, the statement does not say at all.
Why a distillation attack targets an aggregation point
Distillation is originally a legitimate training technique: a new model learns from a strong model's outputs in bulk, replicating much of its ability at far lower cost than training from scratch. Turned into an attack, it runs on scale — the attacker hides inside normal-looking calls, queries the target model massively, collects the answers, and trains a model of their own on that data. For model providers, this bypasses licensing and billing while copying their most valuable asset, which makes it one of the hardest forms of API abuse to police.
An aggregation entry point like OpenCode Console is especially attractive to such attackers: a single account reaches several providers' frontier models at once, so one intrusion can touch many targets in bulk. That also explains why Anthropic, OpenAI and Google appear together on the remediation list — what needs cutting off is not one model's exposure but a single abused calling chain. This reading is an inference from what OpenCode has disclosed; the concrete attack path still awaits the company's follow-up.
The open questions outnumber the answers
The gaps in this disclosure are exactly what users care about most: by what criteria the 1.4% were judged affected, how long the attack lasted, how much model output was harvested, and whether attackers obtained user credentials or billing information. OpenCode says only that the incident is ongoing and more detail cannot be shared yet, which suggests a second statement will follow. Until then, Console users who received the email should follow its instructions first; users who did not should not treat themselves as entirely unaffected — watching recent call volumes and billing anomalies is the cheapest self-check in an incident like this.
For the wider industry, the episode puts an old problem on the table: as model capability concentrates behind a few aggregation points, distillation defence stops being any single provider's own problem. Who is calling, whether call volumes look abnormal, and whether outputs are being systematically harvested can only be seen when platforms and upstream providers share signals. Whether OpenCode's next disclosure lays out the attack path and the true scope will decide if this ends as a prompt notification or as evidence of a shared weak spot across aggregation platforms. OpenCode had just made DeepSeek V4.1 Flash free inside its platform on October 15, and with platform call volumes in a growth phase, abuse of this kind only gets harder to spot.
