Do Son 
An AI Service Loses More Than Prompts
AI services store more than user prompts. They also hold keys that let them call third-party models on a user’s behalf. This time, those keys are at risk.
OpenCode has disclosed a security breach tied to a large-scale AI distillation attack. The incident affected 1.4 percent of OpenCode Console users. The company announced it on October 17, 2026, and says its investigation continues.
What OpenCode Has Disclosed
According to OpenCode, the affected users had connected external model providers. Console lets teams save access keys in a shared workspace. As a result, team members can use AI models without direct access to the keys themselves.
The notice says the saved third-party keys may have reached outsiders. The trigger was unauthorized access to a legacy system that the company was retiring.
The Distillation Link
OpenCode ties the incident to a model distillation attack. In this method, attackers collect huge volumes of answers from an existing AI model. They then use that data to train another model that copies part of its abilities.
However, OpenCode has not yet explained how the intruders got in. It has also not said what data they took, or how the leak connects to distillation.
Who Is Responding
Anthropic, OpenAI, and Google are helping with the cleanup. OpenCode says it has notified every user it considers affected. By its account, users who received no email were not harmed.
Still, the company has published no details of the investigation so far.
What Affected Users Should Do
Users who received a notice should act quickly:
- Revoke the compromised keys in each provider’s dashboard.
- Create new keys to replace them.
- Review API usage history and spending for unknown requests.
As of October 19, 2026, publicly confirmed facts about the cause of the intrusion and the full scope of the leak remain limited.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
