OpenCode distillation attack breach — OpenCode Console users with linked AI providers had credentials exposed; attacker can run inference on victim accounts (no CVE)
Severity: high · Patch status: no-fix-needed · Since 2026-10-18
On 2026-10-18 OpenCode disclosed a security breach tied to a large-scale 'distillation attack' affecting 1.4% of OpenCode Console users who had external AI providers (Anthropic, OpenAI, Google) linked to their accounts. OpenCode says it emailed every impacted user the morning of October 18; users who received no email were not impacted. The incident is ongoing and the vendor has not published a root cause or said what data was accessed. Linked provider credentials are stored locally at ~/.local/share/opencode/auth.json (or the Windows equivalent); if exposed, attackers can run inference against the victim's provider account, causing unexpected spend and potential access to data the keys can reach. No affected CLI versions were identified — impact is scoped to Console accounts with linked providers, not CLI installs. Remediation centers on rotating linked API keys and reviewing provider usage dashboards.
What to do
- Check whether your organisation received OpenCode breach notification emails; per the vendor, no email means not impacted
- Find machines running OpenCode (check which opencode, ~/.opencode/bin, ~/.config/opencode, ~/.local/share/opencode/auth.json, or scan with StepSecurity Dev Machine Guard)
- Inspect auth.json to identify linked Anthropic, OpenAI, or Google providers
- Rotate any Anthropic, OpenAI, or Google API keys linked to OpenCode or OpenCode Console
- Review provider usage dashboards for unauthorised inference requests and unexpected spend
- Maintain an inventory of AI coding agents and linked credentials across developer machines
Sources
All live incidents on Threat Watch
