INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

OpenCode API keys exposed amid AI distillation attacks launched

| 2026-10-19 17:27 LOW HIGH AI-ENABLED ATTACK · AUTONOMOUS DATA BREACH
JSON
Executive Summary
AI-generated
On October 17, 2026, at 00:30 UTC, a large-scale distillation attack was launched against OpenCode, exposing API keys of users who linked external providers such as Anthropic, OpenAI, and Google. The breach affected approximately 1.4% of OpenCode Console users, resulting in unauthorized API charges ranging from several hundred USD to over $1,700 for some users. The attackers exploited the legitimate machine-learning technique of distillation by training smaller AI models using responses generated by more powerful models through unauthorized queries. After a 48-hour attack period, OpenCode stabilized its systems by utilizing OpenAI's Daybreak AI cybersecurity model and notified affected users via email, offering reimbursement for those impacted.
Technical Mitigations AI-generated
• Use OpenAI’s Daybreak AI cybersecurity model for defensive work, approved by OpenCode. • Monitor API keys and external provider connections regularly to detect unauthorized access. • Implement a robust security safeguard system that can block or hunt for large-scale distillation attacks.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope
Incident Timeline
‎October 17, 2026
Threat actors used AI distillation attacks to expose API keys of OpenCode, prompting an email notification to impacted users.
organisation BleepingComputer
BleepingComputer contacted OpenCode for more details, but we have not heard back as of publication.
organisation The Blue Report 2026
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
‎2026/10/19
Attackers used AI agents to target OpenCode's systems for at least 48 hours, resulting in the exposure of API keys among affected users.
organisation API
OpenCode hack exposes API keys amid AI distillation attacks.
organisation OpenCode
The open-source AI coding project OpenCode has notified some users that stored API keys they used with external providers were exposed in a security breach.
organisation Google
Distillation attack On Saturday, OpenCode announced that it suffered a large distillation attack that impacted only developers who linked external providers, including Anthropic, OpenAI, and Google.
organisation Distillation
Distillation is a legitimate machine-learning technique that trains smaller AI models using responses generated by more powerful models.
organisation OpenAI’s Daybreak AI
Distillation attack on OpenCode ran for 48 hours source: Dax Raad Raad said the situation stabilized after OpenCode began using OpenAI’s Daybreak AI cybersecurity model for defensive work, which it was approved to use on Saturday.
financial $1,700 users
According to the project maintainer, the breach affected 1.4% of OpenCode Console users, with some reporting more than $1,700 in unauthorized charges overnight.
Tactical Metrics
Metrics
financial
1,700
Financial Impact / Stolen Funds
According to the project maintainer, the breach affected 1.4% of OpenCode Console users, with some reporting more than $1,700 in unauthorized charges overnight.
Intelligence Sources
BleepingComputer 2026-10-19