OpenCode reports a Console security incident affecting linked providers

The short version

OpenCode says a security breach tied to a large-scale distillation attack affected 1.4% of Console users, specifically a subset with external providers linked.

What changed

OpenCode has notified affected Console users by email and says remediation is ongoing with Anthropic, OpenAI, and Google.

What it means for you

Teams using external-provider connections in OpenCode Console should check their notification email and follow OpenCode's incident updates before relying on those connections.

OpenCode has reported a security incident affecting a defined slice of its Console users. Its official update says a large-scale distillation attack led to a breach affecting 1.4% of Console users. The company has not published technical details of the attack, so this report does not infer the exposed data, attacker access, or root cause.

The stated scope matters for teams that connect external model providers to OpenCode Console. OpenCode says the affected population was limited to users with external providers linked. It says it notified affected users by email and that a user who did not receive that email was not affected. That is the current vendor guidance, rather than an independent forensic finding.

OpenCode also says the incident remains ongoing and that it is working with Anthropic, OpenAI, and Google on remediation. The announcement does not give a completion time or prescribe a credential-rotation procedure. Treat later vendor updates as authoritative if they change that guidance.

For now, Console administrators should confirm whether the team received the incident email, inventory any linked external providers, and monitor the official update before assuming the connections are unaffected. Keep this distinct from OpenCode's local or self-hosted workflows: the announcement specifically names OpenCode Console users with linked external providers.

Related catalog entry

Fact check

VerifiedOpenCode reported a security breach related to a large-scale distillation attack that affected 1.4% of OpenCode Console users.Evidence

VerifiedThe affected users were a subset with external providers linked; OpenCode says it emailed affected users and that users who did not receive an email were not affected.Evidence

VerifiedOpenCode says the incident is ongoing and it is working with Anthropic, OpenAI, and Google to remediate it.Evidence