Physix FrontierPhysix Frontier · News Briefing Card (IT Home · Oct 18, 2026)
OpenCode Hit by Distillation Attack, 1.4% of User API Keys Leaked
KEY FACTS
- OpenCode suffered a security incident on the evening of October 16 local time, hit by a large-scale distillation attack.
- The incident affected 1.4% of OpenCode Console users, and the company emailed those affected the next day.
- Attackers gained unauthorized access to an old system that OpenCode was in the process of decommissioning.
- API keys for external providers such as OpenAI and Anthropic in user workspaces may have been leaked.
- OpenCode is working with Anthropic, OpenAI, and Google on remediation measures.
KEY DATA
1.4%Share of affected users
$400User-reported unauthorized Anthropic charges
about 200 eurosUser-reported Google service charges
PHYSIX OBSERVATION
The decommissioning period of an old system became a security blind spot, a reminder to every AI tool platform: key custody is no small matter. When users hand their API keys to a third party, they are handing over their wallets. Platforms should encrypt by default, rotate keys regularly, and support fine-grained permissions, otherwise a single leak can send user bills out of control. The industry needs stricter key management standards.
Source: IT Home report