OpenCode discloses distillation attack that hit 1.4% of Console users
OpenCode disclosed a security breach on October 17, 2026, where attackers exploited a legacy system to steal API keys for Anthropic, OpenAI, and Google models. This allowed attackers to run queries on affected users' accounts, resulting in bills of hundreds of dollars for some.