Services for working with artificial intelligence store not only requests, but also keys that allow you to access third-party models on behalf of the user. OpenCode reported a security breach involving a large-scale AI distillation attack that affected 1.4% of OpenCode Console users. The company said the incident on October 17, 2026, and reported that the investigation was ongoing.
According to OpenCode, some of the users who connected external suppliers of models were threatened. Console allows you to save access keys to services in the workspace so that team members can use AI models without direct access to the keys themselves. According to the notification, the saved keys of third-party providers could get to outsiders after unauthorized access to the outdated system that the company was decommissioning.
The company linked the incident to the attack on the distillation of the models. This method involves mass receiving responses from the existing AI model and using this data to train another model capable of replicating some of its capabilities. However, OpenCode has not yet revealed how the intruders entered the system, what data were obtained and how the leak was related to distillation.
Anthropic, OpenAI and Google are involved in the elimination of the consequences. OpenCode reported that it sent notifications to all users who were found to have been affected by the incident. According to the company, users who did not receive such a letter were not injured. At the same time, details of the investigation have not yet been published.
Users who have been notified should withdraw the compromised keys in the offices of the respective suppliers and create new ones. It is also recommended to check API usage history and costs for unknown requests. As of October 19, 2026, publicly confirmed information about the causes of penetration and the full extent of the possible leakage remain limited.
According to OpenCode, some of the users who connected external suppliers of models were threatened. Console allows you to save access keys to services in the workspace so that team members can use AI models without direct access to the keys themselves. According to the notification, the saved keys of third-party providers could get to outsiders after unauthorized access to the outdated system that the company was decommissioning.
The company linked the incident to the attack on the distillation of the models. This method involves mass receiving responses from the existing AI model and using this data to train another model capable of replicating some of its capabilities. However, OpenCode has not yet revealed how the intruders entered the system, what data were obtained and how the leak was related to distillation.
Anthropic, OpenAI and Google are involved in the elimination of the consequences. OpenCode reported that it sent notifications to all users who were found to have been affected by the incident. According to the company, users who did not receive such a letter were not injured. At the same time, details of the investigation have not yet been published.
Users who have been notified should withdraw the compromised keys in the offices of the respective suppliers and create new ones. It is also recommended to check API usage history and costs for unknown requests. As of October 19, 2026, publicly confirmed information about the causes of penetration and the full extent of the possible leakage remain limited.
