OpenCode Affected 1.4% of Users by Distillation Attack
OpenCode disclosed a security incident last night involving a large-scale distillation attack, affecting 1.4% of OpenCode Console users.
The affected range is limited to a subset of users associated with external service providers. The team has notified all affected users via email this morning, and those who did not receive an email are confirmed to be outside the affected range.
Attackers gained unauthorized access to legacy systems that are in the decommissioning process. Third-party provider keys stored in the workspace, including those from OpenAI and Anthropic, may have been exposed. Affected users are urged to immediately revoke and replace keys through the provider's backend, update related applications, and check recent usage records.
Some users reported unauthorized queries leading to abnormal billing, with amounts ranging from tens to hundreds, and even exceeding a thousand dollars, involving Anthropic, OpenAI, and Google accounts.
The incident is still under processing, and the team stated that they cannot disclose more technical details. OpenCode is working with Anthropic, OpenAI, and Google to carry out remedial actions. Anthropic has revoked some of the affected Claude API keys, and Google has also blocked the exposed Gemini API keys.
Attackers launched a large number of queries against cutting-edge models using the obtained user keys to collect output data for model distillation. Funds flowed from user prepayments or linked accounts to model providers, with users directly bearing the costs and key risks, while attackers obtained high-value outputs that could be used to train downstream models.
Source: Public Information
ABAB AI Insight
Anomaly Innovations, formerly the SST team, was founded by Jay V and Frank Wang, and received funding from Y Combinator in 2021. After accumulating over 25,000 GitHub stars with its early product SST, it shifted to terminal AI programming tools. OpenCode was launched in June 2025, positioned as an open-source coding agent supporting multi-provider model access. Previously, the team had conflicts with Anthropic regarding subscription credentials and third-party harness access, ultimately removing support for Claude Pro/Max credentials and shifting to its own gateway and BYOK model.
OpenCode Console allows users to store keys from providers like OpenAI, Anthropic, and Google in the workspace for multi-model routing and sharing. After attackers obtained these keys from legacy systems, they directly initiated high-concurrency queries against cutting-edge models as users, batch collecting outputs for distillation training. This path converts user prepayments or linked credits into a free training data source for attackers while circumventing provider risk controls against direct large-scale queries.
Similar cases can be seen in previous API key leakage incidents involving AI tools and proxy platforms, where attackers made unauthorized calls to upstream models using credentials stored in third-party consoles. OpenCode is currently transitioning from an open-source terminal agent to a phase of expanding managed console and enterprise features, with centralized key storage becoming a new attack surface, differing from the risk structure of earlier purely local or self-hosted tools.
This incident essentially represents a transfer of access rights in the restructuring of the industry chain: model providers open inference capabilities in API form, downstream tools centralize key management for convenience, and attackers convert user payment limits into scalable training signals. Providers have begun responding by revoking keys and detecting anomalies, promoting key rotation and spending limits as default practices to reduce the single point exposure risk brought by centralized management.
ABAB News · Cognitive Laws
Centralized key storage equals centralized attack surface
Convenient access equals free training data
Users pay, attackers distill, platforms remedy