OpenCode, the open-source AI coding agent, said on October 17 that a breach tied to what it called a large-scale distillation attack hit 1.4% of users of OpenCode Console, its hosted service, and that it had emailed those affected. BleepingComputer and TechCrunch report that only users who had linked external providers (Anthropic, OpenAI, Google) were affected, that some reported hundreds to over $1,700 in unauthorized charges, and that Google suspended some projects. Co-founder Dax Raad said the open-source app and CLI were not affected; the company has not said how attackers got in. OpenCode told users to revoke their keys and says refunds are underway. Raad said AI models first refused to help the investigation until it switched to OpenAI's Daybreak cybersecurity model.

On Hacker News, commenters asked why a hosted service held provider keys at all, questioned the unproven 'distillation' label, and argued over earlier warnings about the project's data practices.