> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # OpenCode breach exposes linked AI provider credentials via distillation attack - URL: https://f4n6.co.uk/security-feed/opencode-breach-exposes-linked-ai-provider-credentials-via-distillation-attack/ - Published: 2026-10-19T09:41:58.000Z - Updated: 2026-10-19T09:41:58.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary OpenCode, an open source AI coding agent, disclosed on 18 October 2026 a security breach it attributes to a "large scale distillation attack" affecting 1.4% of OpenCode Console users, all of whom had external AI providers (Anthropic, OpenAI, Google) linked to their accounts. The vendor says it emailed every affected user on the morning of 18 October and that the incident is ongoing; no root cause, no confirmation of what data was accessed, and no confirmation that provider API keys were exposed have been published. No CVE has been assigned and no exploitation status is recorded against this item. The risk to EMEA financial services is indirect but concrete: developers who linked provider accounts to OpenCode may have credentials that permit inference billed to the firm, and most security teams cannot currently enumerate which developers run which AI coding agents. Treat this as a credential-exposure and third-party visibility problem, not a malware incident. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. ## 3\. Technical analysis & attack chain The public record does not support a confirmed attack chain. OpenCode has published a single statement on X and nothing else; the vendor has not described initial access, the mechanism of the "distillation attack", what was accessed, or whether linked provider credentials were among the data taken. What follows separates what is stated from what is inferred, and the inferred material is caveated. Confirmed facts, all from the vendor statement as relayed by StepSecurity: 1. OpenCode detected a security breach on the night of 17 to 18 October 2026. 2. The vendor characterises it as a "large scale distillation attack". 3. Impact is scoped to 1.4% of OpenCode Console users. 4. The affected subset had external providers linked; OpenCode names Anthropic, OpenAI, and Google. 5. OpenCode emailed all affected users on the morning of 18 October. 6. The incident is ongoing and the vendor is working with Anthropic, OpenAI, and Google to remediate. What "distillation attack" means here is not defined by the vendor. In machine-learning usage, distillation is the process of training a smaller model on the outputs of a larger one; an attack framed that way would involve extracting model behaviour through the platform rather than compromising endpoints. StepSecurity states it has not seen details on what data was accessed, whether provider API keys were exposed, or what the term means in this context. Any reading beyond that is speculation and should not drive containment decisions. The exposure path that matters for defenders is the credential linkage. Developers link AI provider accounts to OpenCode so the agent can call models on their behalf. OpenCode stores provider credentials in a local auth file, which StepSecurity gives as `~/.local/share/opencode/auth.json` on macOS and Linux and `%USERPROFILE%\.local\share\opencode\auth.json` on Windows. If those linked credentials were exposed, an attacker could run inference against the victim's provider account, which surfaces as unexpected spend and, depending on the provider, access to whatever data those keys can reach. That is StepSecurity's assessment of the possible consequence, not a confirmed finding of the breach; the vendor has not said keys were taken. Two scoping points are worth holding onto. Impact is scoped to OpenCode Console users, not everyone who has the OpenCode CLI installed, so a developer with the CLI and no Console account is outside the stated affected population. And the vendor's position is that users who received no email were not impacted. That position rests entirely on the vendor's notification being complete and accurate, which cannot be verified from outside. No indicators of compromise, no malware capability, no persistence mechanism, no command-and-control detail and no exfiltration evidence are present in the source material. The entire technical picture rests on one vendor statement and one security vendor's commentary; it is single-sourced and should be treated as such. ## 4\. Mitigation & containment P1, within 24 hours: - Enumerate developer machines running OpenCode. StepSecurity's Dev Machine Guard detects the OpenCode CLI binary, its config directory and its MCP server configuration on macOS, Windows and Linux; it is open source and runs as a one-time scan on a single machine, with the AI Agents and Tools section of the output listing OpenCode if installed. For fleet-wide visibility, deploy it through your MDM. The tool reports what is installed and does not tell you whether a developer has a Console account or which providers they linked, so the inventory is the start of the process, not the end. - For every developer on that list, have them run `cat ~/.local/share/opencode/auth.json` (or open `%USERPROFILE%\.local\share\opencode\auth.json` on Windows) and report which providers appear. Every provider listed in that file is a credential worth rotating. - Rotate any Anthropic, OpenAI or Google API keys connected to OpenCode or the OpenCode Console. Then review each provider's usage dashboard for requests the developer did not make. - Ask each developer whether they received the OpenCode notification email of 18 October. Per the vendor, no email means not impacted; record the answer rather than relying on it silently. P2, within 72 hours: - Reconcile provider billing and usage against expected developer activity for the period from the breach onward, and flag inference volume that no developer claims. - Where a linked key had broader reach than inference alone (access to stored data or other provider resources), treat the key as compromised regardless of whether the vendor confirms exposure, and review what that key could reach. P3, within 7 days: - Build and maintain a standing inventory of AI coding agents across the developer fleet, with installed versions, so the next vendor disclosure of this kind can be answered from a list rather than a survey. - Add linked AI provider credentials to the joiners, movers and leavers process and to periodic key-rotation schedules. No vendor fix, patch version or configuration change is available: OpenCode has published no root cause and no remediation guidance. Do not pin or downgrade versions on the basis of this advisory. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The source describes no hashes, domains, IP addresses, filenames of malicious artefacts or command lines. The only file paths given are legitimate OpenCode credential stores, which are not indicators and are not reproduced as such. Behavioural indicators are limited to provider-side billing anomalies, which are observable in each provider's usage dashboard rather than in endpoint or network telemetry. ## 6\. Detection Insufficient indicators to author detection rules. The source contains no distinctive strings, command-line flags, mutex names, file paths belonging to an attacker, registry keys or hard-coded values. The OpenCode auth file paths are legitimate application artefacts and would generate false positives across every developer running the tool; they are not threat artefacts and no rule is emitted against them. ## 7\. Sources - StepSecurity, "OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respond", 18 October 2026\. https://www.stepsecurity.io/blog/opencode-security-breach - OpenCode vendor statement, posted on X, 18 October 2026, as quoted in the StepSecurity post above. The original post was not retrieved directly; the quotation is second-hand. ## 8\. Adverse Trace position Adverse Trace assesses this as a low-to-moderate severity item with high uncertainty. No CVE has been assigned and no exploitation status is recorded, the vendor has confirmed neither the data accessed nor the exposure of provider API keys, and the entire technical account rests on one vendor statement plus one security vendor's commentary. The client impact is a credential and cost exposure on linked Anthropic, OpenAI and Google accounts, plus a visibility gap: most firms cannot say which developers run which AI coding agents. We will monitor OpenCode, Anthropic, OpenAI and Google for a root-cause statement or confirmation of key exposure and reissue this advisory if either appears; in the meantime we recommend clients complete the P1 inventory and rotation steps above rather than wait for vendor detail. --- [Read the original source →](https://www.stepsecurity.io/blog/opencode-security-breach?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*