I hope this is a good reminder of the blast radius when you link provider keys into third-party tools.
1.4% still equates to a lot of people. If you were emailed, rotate those keys and review your recent usage. If you didnât, maybe take the hint anyway.
Distillation attacks were always going to target whatever had easy access to the frontier models.
We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate