On 18 October 2026, OpenCode, the open-source AI coding agent, disclosed a security breach it tied to a "large scale distillation attack." By the company's own account, 1.4% of OpenCode Console users were affected, specifically those who had linked external AI providers. The providers it named are Anthropic, OpenAI and Google, and OpenCode says it is working with all three on remediation.
OpenCode emailed every affected user on the morning of 18 October and says anyone who did not get an email was not impacted. The incident is still ongoing. No root cause has been published, and the company has not said what data was accessed.
Why linked keys are the real exposure
Developers connect their model provider accounts to tools like OpenCode so the agent can call models on their behalf. If those credentials leak, an attacker can run inference on the victim's account. The first symptom is usually unexpected spend. Depending on how the key is scoped, it can also mean access to whatever data that provider account can reach.
The word "distillation" matters here. Distillation attacks usually aim to pull large volumes of output from a strong model to train a cheaper copy. Stolen provider keys are a convenient way to do that on someone else's bill.
The CLI version won't tell you
StepSecurity, which published a response guide, points out that the breach is tied to Console accounts with linked providers, not to a specific release of the OpenCode CLI. Checking which version a developer has installed will not tell you whether they were hit.
What matters is whether the developer has a Console account and linked a provider. OpenCode stores linked credentials locally at ~/.local/share/opencode/auth.json on macOS and Linux, and under %USERPROFILE%\.local\share\opencode\auth.json on Windows. If that file exists and lists a provider, treat the developer as potentially affected until OpenCode's email says otherwise.
What to do this week
- Find out who runs OpenCode. Most security teams have no inventory of AI coding agents on developer machines. Start one now.
- For each of those developers, check for the OpenCode notification email and read the
auth.jsonfile. - Rotate every Anthropic, OpenAI or Google key that was ever connected to OpenCode or its Console.
- Review usage dashboards at each provider for requests the developer didn't make.
Agents hold the keys now
AI coding agents hold some of the most valuable credentials in a company, keys that spend money and touch data. Individual developers usually install them, and nobody keeps a central record. OpenCode's breach hit a small share of users, but it shows where supply-chain exposure is heading. If you can't say which agents run on which machines with which keys, close that gap first.
