OpenCode discloses distillation attack exposing 1.4% of users' API keys
10/18/2026 — 10/18, 05:16·2 sources (all)·2 reports (all)·In the 2026-10-18 briefing
Key takeaways
- Anomaly Innovations, the company behind the open-source coding agent OpenCode, said a large-scale distillation attack affected about 1.4% of…
Background & analysis
On October 18, 2026, OpenCode published an official statement about a distillation attack. According to TestingCatalog, the company said that earlier that day, the OpenAI, Anthropic and Google balances of some OpenCode users had been drained. Reportedly, only 1.4% of users were affected, and those users were notified by email.
Later the same day, Techmeme cited a Startup Fortune report saying that Anomaly Innovations, the company behind the open-source coding agent OpenCode, described a "large scale distillation attack" that hit roughly 1.4% of OpenCode Console users and exposed their stored API keys. That report said the exposed material involved stored OpenAI credentials.
Both accounts agree on the roughly 1.4% figure, but they differ on what was affected: one points to drained OpenAI, Anthropic and Google balances, while the other points to leaked API keys stored by OpenCode Console users, specifically naming OpenAI credentials. The public record currently stops at OpenCode's statement and the email notification to affected users.
AI-generated from 2 reports · updated 1 hour ago
Latest turnAnomaly Innovations, the company behind the open-source coding agent OpenCode, said a "large scale distillation attack" affected about 1.4% of OpenCode Console users and exposed their stored API keys, according to Startup Fortune. The report says the leaked material includes stored OpenAI credentials.
Related AI tools
- Heat index
- 187
- All sources
- 2
- All reports
- 2
- First seen
- 3 hours ago
Reports on this story headlines open the original
Anomaly Innovations, the company behind the open-source coding agent OpenCode, said a "large scale distillation attack" affected about 1.4% of OpenCode Console users and exposed their stored API keys, according to Startup Fortune. The report says the leaked material includes stored OpenAI credentials.
TechmemeAI score 52TestingCatalog reports that OpenCode published an official statement on a recent distillation attack in which the OpenAI, Anthropic and Google balances of some OpenCode users were drained. Reportedly only 1.4% of users were affected, and those users were notified by email.
X：TestingCatalog (@testingcatalog)AI score 53
Other stories people are talking about
- Heat index 25Claude Code Agent Bypasses Isolation and Deletes Files1 sources
- Heat index 603RisingDeepSeek V4.1-Flash-1017 lands on Ollama Cloud8 sources
- Heat index 840Meta Open-Sources Muse Spark Open for Local Apple Silicon Deployment22 sources
- Heat index 411Reflection open-sources Beam weights and post-training recipe11 sources
- Heat index 356OpenAI discloses multiple model overreach incidents, including 24 years of hospital data7 sources
How is heat calculated?About the methodHide
Heat counts how many independent sources covered a story in the last 48 hours: one source counts once no matter how many posts it published, decaying with a 24-hour half-life. What ranks first is what many people are talking about.
This page aggregates public feeds. Headlines and summaries are machine-organized and remain the property of the original authors; verify important facts at the source. If you believe a headline or summary infringes your rights, email the contact address in the footer with the page URL and basis of your claim, and we will remove or replace it after review.
- Surge
- Discussion rising fast
- New
- First report within 6 hours
- Rising
- Still gathering discussion