OpenCode Issues Statement on Distillation Attack: 1.4% of Users Affected, OpenAI, Anthropic, Google Balances Drained
OpenCode released an official statement on a large-scale distillation attack, saying the incident affected 1.4% of OpenCode Console users, specifically a subset of users who had linked external providers. Those users were notified by email that morning; anyone who did not receive an email was not affected. TestingCatalog reported that the balances of some OpenCode users on OpenAI, Anthropic, and Google were drained. The incident is still being handled, and OpenCode is working with the three companies to remediate it.
Why read this
AI score 60
OpenCode disclosed that a distillation attack affected 1.4% of users, highlighting the account security risks when third parties connect to external models.
Topics
View original postWe had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate
View original
We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate
Body
OpenCode published an official statement regarding a recent distillation attack.
> Earlier today, OpenAI, Anthropic and Google balances of some OpenCode users got drained.
> Reportedly, only 1.4% of users were affected and these users were notified via an email.
This is a serious precedent because if this distillation vector is the simplest to execute, that means that major AI labs are now much more protected than they were earlier. This also means that using smaller providers is now less safe.
Additionally, tokens from leading AI labs now have a higher value since they are harder to get for distillation.
A wild AI west 👀