OpenCode Data Breach Exposes API Keys Linked to Third-Party Services

OpenCode has reported a security breach affecting 1.4% of its Console users, which it attributes to a “large-scale distillation attack.”

The company said the affected accounts belong to a subset of users who had connected external providers. However, the public disclosure did not clarify if API keys were extracted or identify which specific credentials were compromised.

OpenCode Data Breach

In its statement, OpenCode confirmed that it emailed all affected users the following morning. The company also assured that users who did not receive a notification were not impacted.

This assurance is based on OpenCode’s assessment of the incident rather than an independently verified conclusion.

The announcement shifts the investigation’s focus to third-party provider integrations. However, OpenCode has not detailed how attackers accessed the affected environment, which integration components were involved, or whether the breach exposed stored secrets, account information, or other sensitive data.

“We had a security breach last night related to a large-scale distillation attack that impacted 1.4% of OpenCode Console users,” the company stated. This announcement was made on its official X account on October 17.

OpenCode is collaborating with Anthropic, OpenAI, and Google to address the incident. Their involvement does not inherently suggest that these providers’ infrastructure was compromised. Additionally, it is unclear whether all affected accounts were connected to any of these three companies.

While the company linked the breach to distillation activity, it has not provided a technical explanation for that connection. It has not disclosed a sequence of events outlining whether unauthorized access facilitated the activity, whether compromised integrations were misused, or how investigators detected the incident.

As a result, the provided disclosure does not verify claims of stolen API keys, automated model extraction, unauthorized inference requests, or potential financial losses.

OpenCode has not published indicators of compromise, information about the attackers, affected integration versions, or a detailed remediation timeline. It also has not disclosed the total number of impacted accounts, making the reported percentage insufficient to calculate the absolute number of affected users.

“The incident is ongoing, so we cannot share more details at this point,” OpenCode stated, explaining the limited availability of technical information.

For affected customers, the notification emails are the company’s stated channel for incident communication. The public statement does not replicate the emails’ contents or specify the actions customers should take.

Further disclosure is necessary to establish the exact extent of the exposure, the status of credentials, the mechanism of the attack, and the outcomes of remediation efforts.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.