IT Home On October 18, OpenCode announced that a security incident occurred last night (local time on October 16), involving a large-scale “distillation attack”which affected 1.4% of OpenCode Console users.
We have notified all affected users via email this morning (local time on October 17). If you did not receive the email, it means you were not affected by this event; only some users who are connected to external service providers were affected.
Since the incident is still being processed, we cannot reveal any further details at this time. However, we are working with Anthropic, OpenAI, and Google to implement remedial measures.
A email shared by a netizen shows that OpenCode claimed that someone accessed an old system of the company that was in a decommissioning process without authorization.
The company warns that the API keys stored in users’ work areas (such as those of OpenAI and Anthropic) may have been leaked. Once someone obtains these keys, they can make requests in the name of the account holder, resulting in associated fees.
In related discussions, several users reported unexpected fees. One user said that their Anthropic account experienced unauthorized deductions of $400 (IT Home note: approximately 2,679 RMB at current exchange rate); another user stated that their Google services fees amounted to about 200 euros (approximately 1,505 RMB at current exchange rate), and the service was suspended due to “excessive abuse”.
In addition, users mentioned that they had received reminders about service usage from OpenAI and Anthropic before receiving any notice from OpenCode regarding this security incident.
