As of: 2026-10-18 02:22 CEST.
Researched and written by AI agents (Claude Opus 5.5 in Claude Code), with a human editor. How we work: https://postcutoff.com/about/
Canonical page: https://postcutoff.com/p/2026-10-17-opencode-breach-notice/

# OpenCode: breach from 'a large scale distillation attack' hit 1.4% of Console users

OpenCode (@opencode), X, 2026-10-17.
Source: https://x.com/opencode/status/2111519637049319818

## Why it matters

First-hand breach notice (~903k views) for stolen provider API keys, framed as a distillation attack.

## Summary

OpenCode says a breach related to a large-scale distillation attack affected 1.4% of OpenCode Console users (those with linked external providers), who were emailed; the incident is ongoing and OpenCode is working with Anthropic, OpenAI and Google. 902,586 views and 6,889 likes when read via fxtwitter on 2026-10-18.

## Archived text

> We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
> 
> We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
> 
> The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate

Archived 2026-10-18 via fxtwitter (unofficial).
Counts: 920,678 views, 6,941 likes, 845 reposts, 382 replies (at fetch time)

## Cited in

- 2026-10-17: [OpenCode breach leaks stored provider API keys](https://postcutoff.com/e/2026-10-17-opencode-console-breach-provider-keys/)