OpenCode Console Breach: Stolen Keys, $300–$1,700 Bills, and the "Distillation Attack" Nobody Buys
OpenCode — the open-source coding-agent harness and YC company — disclosed a breach of its Console affecting "1.4% of OpenCode Console users," described as "a large scale distillation attack," hitting "a subset of users who had external providers linked," with the warning that "Third party keys saved in your workspace may have been exposed" (nl quoting the disclosure). OpenCode and OpenAI issued refunds after the incident. The concrete damage: "There's countless reports of OpenCode users impacted by this who woke up to $300-$1700 bills from Anthropic and OpenAI, but OpenCode didn't mention this or offer to compensate users" (smileybarry).
The community revolted against the naming as much as the breach. "Does anyone understand why they are calling this a distillation attack?" (nl) got the thread's consensus answer from duhhhhh1212: "They think their customers reading that post are idiots so it's easy to convince them of the distillation boogeyman instead of owning the breach." (50139582). searealist's analogy stuck: "I once had my credit card stolen and it was used to purchase gift cards. Interestingly, no one referred to it as a 'gift card attack'. Between 'distillation attack' and 'under attack by agent swarms', it's probably to absolve themselves of responsibility by making it seem like an unavoidable arms race." (50143479). verdverm noted the vendors themselves "have been chanting the distillation song for a year. They have provided no evidence, they need to provide an open dataset ... so that we can analyze and decide for ourselves." (50140878).
There's also a moderation meta-story: an earlier submission of this breach was "the most-upvoted submission of the last 24 hours" before vanishing from the front page (WalterGR), and "lots of people are sus about how fast it fell from the front page given the metrics, OpenCode is a YC company" (verdverm).
Why it matters: agent harnesses that hold users' provider API keys are becoming the key-custody single point of failure of the agentic stack — one console compromise converts directly into six-figure fraud at the model vendors. The emerging practice, per verdverm: "Don't proxy your subs through any one vendor, own your keys, because this is just one of many such events" (50141951); containerize and pin the harness itself (kadoban). And "distillation attack" now joins "agent swarms" in HN's lexicon of vendor euphemisms — expect the term to be pre-rejected in the next incident. Fits the pattern tracked in OpenAI Discloses Four More Rogue Incidents — and HN Fights Over Who Goes to Jail for Agent Crime and Agentic Security: From Copilot Exfiltration to Interactive Deception and Autonomous Supply-Chain Attacks: the agentic ecosystem's trust layer is failing faster than its capability layer is improving.