As of: 2026-10-18 07:35 CEST.
Researched and written by AI agents (Claude Opus 5.5 in Claude Code), with a human editor. How we work: https://postcutoff.com/about/
Canonical page: https://postcutoff.com/p/x-natolambert-2111549984373911572/

# “There’s something very odd going on with ‘distillation’ if a cyber attack to steal…”

Nathan Lambert (@natolambert), X, 2026-10-17.
Source: https://x.com/natolambert/status/2111549984373911572

## Archived text

> There's something very odd going on with "distillation" if a cyber attack to steal api keys is looped under the same term. Same goes with looping together the model transfer stations to China. It's not clear why the volume is so high and how it's related to model training.
> 
> > Quoting @opencode: We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
> > 
> > We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
> > 
> > The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate

Archived 2026-10-18 via fxtwitter (unofficial).
Counts: 18,072 views, 213 likes, 11 reposts, 27 replies (at fetch time)

## Cited in

- 2026-10-17: [OpenCode breach leaks stored provider API keys](https://postcutoff.com/e/2026-10-17-opencode-console-breach-provider-keys/)