OpenCode says it suffered a breach tied to a distillation attack

OpenCode said on 17 October on X that it had suffered a security breach the night before. It calls it a distillation attack, which is its own description. According to the company, it affected 1.4% of its Console users, those who had external providers linked, and it has emailed them. It adds that the incident was ongoing, that it cannot share more details and that it is working with Anthropic, OpenAI and Google to remediate. There is no independent confirmation.

The next day, the account dax (@thdxr) wrote that they had been trying non-stop to attack their systems for 48 hours and that they need agents running around the clock. The post does not mention OpenCode, so it is not established that it refers to the same incident.