OpenCode says breach affected 1.4% of Console users

OpenCode said a breach involving an older system affected 1.4% of OpenCode Console users, a subset that had linked external providers. The company said it had notified affected users by email and was working with Anthropic, OpenAI, and Google to respond. It described the incident as related to a large-scale distillation attack and said it could not share more details while its response continued. The statement did not identify an access path or root cause, and the reviewed reporting does not establish the attackers’ alleged motive. (OpenCode’s incident statement; TechCrunch)

Co-founder Dax Raad said the incident concerned OpenCode Console, not OpenCode itself. TechCrunch reported, citing Raad, that the open-source app and command-line tool were not affected. The reported scope concerns Console and does not establish that local OpenCode installations or locally configured keys were exposed. (Raad’s scope statement; TechCrunch)

TechCrunch reported user accounts of unauthorized provider charges, including individual reports in the hundreds of dollars and some above $1,000. It reported that Anthropic and Google blocked keys they believed were exposed and that OpenAI worked with OpenCode to restore access and refund API credits. Raad later wrote that refunds were underway. These reports do not establish an aggregate loss or the total number of keys misused. (Raad’s refund update; TechCrunch)

OpenCode told affected users to revoke and replace provider keys directly with each provider. The company’s disclosure does not identify the access path or explain how the older system was breached. The “distillation” label is OpenCode’s characterization, not a finding established by the reviewed reporting.

Model refusals during the response

An October 21 Axios report adds that co-founder Dax Raad said frontier models initially helped investigate the breach, then began refusing requests as the work turned toward potentially malicious code. Raad said the situation improved after OpenCode gained access to OpenAI Daybreak Blue. Axios did not identify which models refused, quantify any delay, or establish that refusals changed the incident or containment outcome. (Raad’s post; Axios)

OpenAI’s August announcement says Daybreak Blue removes the production system-level cybersecurity guardrails that can block legitimate defensive work, with access controlled through identity verification, account security, monitoring, approved-use restrictions, and legal attestations. Its current Daybreak help guide describes Blue as reducing refusals for supported models in verified defensive work and says other safeguards and usage policies continue to apply; approval alone does not enable it. The distinction is that Blue tailors some cybersecurity restrictions for approved work rather than turning off all safety controls. (OpenAI; OpenAI Help Center)