OpenCode discloses distillation attack affecting 1.4% of console users

OpenCode disclosed that a security incident related to a large-scale distillation attack occurred the previous night, affecting 1.4% of OpenCode Console users—specifically those who had linked external service providers. The company notified all affected users by email on the morning of the 18th; those who did not receive an email are not affected. The incident is still being handled, and OpenCode said it is working with Anthropic, OpenAI, and Google to remediate it. The same day, Nathan Lambert raised doubts, arguing that it is strange to lump a cyberattack that stole API keys together with a "model transfer station" under the name "distillation," and that it is unclear how this relates to model training. Subsequently, Anthropic's Lydia Hallie said the team is working with OpenCode to handle the leak incident, has revoked the Claude API keys it believes were affected, and recommends that users who previously saved keys in OpenCode create new keys.

AI-generated from public reports

1. Report date Oct 18· 5 reports

   OpenCode discloses distillation attack affecting 1.4% of console users

   Source:opencode
2. Report date Oct 18· 1 reports

   English translation is being prepared.

   Source:Nathan Lambert
3. Report date Oct 18· 1 reports

   English translation is being prepared.

   Source:Lydia Hallie