OpenCode Hacked: User credentials leaked
- ID
- 36714
- Status
- summarized
- Published
- 18 Oct 2026, 2:01 AM
- Fetched
- 18 Oct 2026, 5:34 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://twitter.com/opencode/status/2111516673953935833
- Source URL
- https://hnrss.org/best
Summary
- Score
- 6.5
- Created
- 18 Oct 2026, 5:34 AM
- Tags
- Audience
- developersvibe_codersai_agent_userssaas_founders
What happened
OpenCode, the open source coding agent, posted on X that it suffered a security breach "last night" tied to what it called a "large scale distillation attack," affecting 1.4% of OpenCode Console users, who were notified by email the following morning. The post says the incident is ongoing, that no further details can be shared yet, and that OpenCode is working with Anthropic, OpenAI, and Google to remediate. The tweet drew 21.7K views and the Hacker News thread drew 439 points and 78 comments, with replies openly asking what a "distillation attack" has to do with leaked credentials and whether affected users would be compensated.
Why it matters
If you or your team run OpenCode Console, the only concrete facts are 1.4% of users affected, email notification sent, and remediation involving three model providers — so check your inbox and your OpenCode Console account, and rotate any Anthropic, OpenAI, or Google API keys that were reachable through that console rather than waiting for a fuller report. The wording matters for your decision: "distillation attack" usually describes model extraction, not credential theft, yet the providers named are the ones whose keys would leak, and the community replies show nobody outside OpenCode can currently tell which it was. Until a postmortem gives scope and timeline, treat this as an unresolved disclosure, not a closed incident. No Malaysia-specific angle is supported by the text.
Discussion angle
What is your default response when a coding-agent vendor discloses a breach with no scope, no root cause, and no timeline — do you rotate keys immediately, and would "1.4% of users" be enough detail for you to decide?