{"schema_version":"0.8.0","id":"LR-2026-0212","record_version":5,"title":"OpenCode large-scale distillation attack compromises 1.4% of Console users, stolen API keys used for unauthorised charges","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":42.8,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":2.56,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true},"gate_version":"gate-2026-09-30.6","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-18","extraction_run_id":null},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":"OpenCode Console","tools_granted":[],"permissions_scope":"Stored API keys for OpenAI, Anthropic and Google used by the coding agent to reach those models","autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":"provider","lifecycle_stage":"production","integration_type":"hosted dashboard storing API keys for third-party model providers","intended_use":"Hosted dashboard where users stored API keys so the open-source coding agent could reach OpenAI, Anthropic and Google models on their behalf","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-18","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"credential_exposure","duration":null,"detection_method":"unknown","summary":"OpenCode disclosed to customers that a “large-scale distillation attack” compromised 1.4% of Console users, with stolen keys being used to rack up unauthorised charges. The document does not state when the attack occurred, how it was detected, or what remediation followed beyond the general advice to rotate keys and set spend caps.","tags":[],"date_detected":null,"near_miss":false,"root_cause":null,"root_cause_detail":null,"failure_class_detail":"No autonomous agent mechanism is described; the incident was a break-in to a hosted dashboard holding API keys, not agent behaviour.","responsible_party":"provider","adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":"OpenAI, Anthropic and Google revoked the compromised keys; OpenCode says refunds for the unauthorized charges are underway.","precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"moderate, because data or systems of others touched, with a bounded scope stated: Credentials of 1.4% of OpenCode Console users were compromised and used for unauthorised charges, a bounded scope of third-party data touched.","harm_class":["financial"],"affected_description":"1.4% of OpenCode Console users; victims of stolen OpenAI, Anthropic or Google keys","protected_class_involved":null,"data_categories_exposed":["credentials"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://agenticaihype.substack.com/p/deepseek-gives-away-a-552b-beast","publisher":"news search (Google News index)","date":"2026-10-18","type":"press","title":"DeepSeek Gives Away a 552B Beast While Microsoft Bottles It in Essex","archived_url":null,"attachment":"first_report"},{"url":"https://startupfortune.com/opencode-breach-let-hackers-burn-users-ai-credits-for-model-theft/","publisher":"news search (Google News index)","date":"2026-10-20","type":"press","title":"OpenCode breach let hackers burn users' AI credits for model theft - Startup Fortune","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.autonomy_level":"D","system.deployment_context":"D","event.adversarial_actor":"C","event.agent_involved":"C","event.incident_class":"D","event.trigger":"C","event.date_disclosed":"A","event.detection_method":"D","event.summary":"C","impact.harm_class":"C","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.severity":"D","context.denominator_available":"D","context.country":"D","impact.severity_because":"D","system.harness":"C","system.permissions_scope":"C","system.tier":"D","system.lifecycle_stage":"C","system.integration_type":"C","system.intended_use":"C","event.near_miss":"C","event.responsible_party":"C","event.remediation":"C","event.failure_class_detail":"D","context.industry":"C","context.systemic_exposure":"C","system.developer":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"OpenCode has told customers a “large-scale distillation attack” compromised 1.4% of Console users, with stolen keys being used to rack up unauthorised charges."},{"source_index":1,"quote":"OpenCode confirmed this week that an unauthorized party broke into a legacy version of its Console, the hosted dashboard where some users stored API keys for OpenAI, Anthropic and Google."}],"event.trigger":[{"source_index":0,"quote":"OpenCode has told customers a “large-scale distillation attack” compromised 1.4% of Console users, with stolen keys being used to rack up unauthorised charges."},{"source_index":1,"quote":"Stolen API keys let them run thousands of dollars in AI queries on other people's accounts, and the real target wasn't the money."}],"event.adversarial_actor":[{"source_index":1,"quote":"OpenCode confirmed this week that an unauthorized party broke into a legacy version of its Console, the hosted dashboard where some users stored API keys for OpenAI, Anthropic and Google."}],"event.agent_involved":[{"source_index":1,"quote":"The breach didn't come from a flaw in the AI agent's reasoning or a clever prompt injection slipped into a code comment."}],"impact.harm_class":[{"source_index":0,"quote":"OpenCode has told customers a “large-scale distillation attack” compromised 1.4% of Console users, with stolen keys being used to rack up unauthorised charges."},{"source_index":1,"quote":"One user reported $281 in unexpected charges on their OpenAI key and $168 on their Anthropic key."}],"impact.affected_description":[{"source_index":0,"quote":"OpenCode has told customers a “large-scale distillation attack” compromised 1.4% of Console users, with stolen keys being used to rack up unauthorised charges."},{"source_index":1,"quote":"The company said 1.4% of Console users were affected, which sounds small until you see what happened to them."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"OpenCode has told customers a “large-scale distillation attack” compromised 1.4% of Console users, with stolen keys being used to rack up unauthorised charges."},{"source_index":1,"quote":"OpenCode confirmed this week that an unauthorized party broke into a legacy version of its Console, the hosted dashboard where some users stored API keys for OpenAI, Anthropic and Google."}],"impact.severity":[{"source_index":0,"quote":"OpenCode has told customers a “large-scale distillation attack” compromised 1.4% of Console users, with stolen keys being used to rack up unauthorised charges."},{"source_index":1,"quote":"OpenCode confirmed this week that an unauthorized party broke into a legacy version of its Console, the hosted dashboard where some users stored API keys for OpenAI, Anthropic and Google."}],"impact.severity_because":[{"source_index":0,"quote":"OpenCode has told customers a “large-scale distillation attack” compromised 1.4% of Console users, with stolen keys being used to rack up unauthorised charges."},{"source_index":1,"quote":"OpenCode confirmed this week that an unauthorized party broke into a legacy version of its Console, the hosted dashboard where some users stored API keys for OpenAI, Anthropic and Google."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-18"},{"source_index":1,"quote":"published: 2026-10-20"}],"system.harness":[{"source_index":1,"quote":"OpenCode confirmed this week that an unauthorized party broke into a legacy version of its Console, the hosted dashboard where some users stored API keys for OpenAI, Anthropic and Google."}],"system.permissions_scope":[{"source_index":1,"quote":"OpenCode confirmed this week that an unauthorized party broke into a legacy version of its Console, the hosted dashboard where some users stored API keys for OpenAI, Anthropic and Google."}],"system.autonomy_level":[{"source_index":1,"quote":"The pattern across nearly all of them is the same: these tools are built to hold powerful, spend-capable credentials so they can act autonomously, and that is precisely what makes a single breach so expensive."}],"system.deployment_context":[{"source_index":1,"quote":"OpenCode confirmed this week that an unauthorized party broke into a legacy version of its Console, the hosted dashboard where some users stored API keys for OpenAI, Anthropic and Google."}],"system.lifecycle_stage":[{"source_index":1,"quote":"The standalone OpenCode app and CLI tool itself were not compromised, the company says; the hole was in the Console, a system it was already in the process of decommissioning."}],"system.integration_type":[{"source_index":1,"quote":"OpenCode confirmed this week that an unauthorized party broke into a legacy version of its Console, the hosted dashboard where some users stored API keys for OpenAI, Anthropic and Google."}],"system.intended_use":[{"source_index":1,"quote":"That's how the open-source coding agent reached those models on their behalf."}],"event.detection_method":[{"source_index":1,"quote":"One user reported $281 in unexpected charges on their OpenAI key and $168 on their Anthropic key."}],"event.near_miss":[{"source_index":1,"quote":"Stolen API keys let them run thousands of dollars in AI queries on other people's accounts, and the real target wasn't the money."}],"event.responsible_party":[{"source_index":1,"quote":"OpenCode confirmed this week that an unauthorized party broke into a legacy version of its Console, the hosted dashboard where some users stored API keys for OpenAI, Anthropic and Google."}],"event.remediation":[{"source_index":1,"quote":"OpenAI, Anthropic and Google have since revoked the compromised keys, and OpenCode says refunds for the unauthorized charges are underway."}],"event.failure_class_detail":[{"source_index":1,"quote":"The breach didn't come from a flaw in the AI agent's reasoning or a clever prompt injection slipped into a code comment."}],"context.industry":[{"source_index":1,"quote":"That's how the open-source coding agent reached those models on their behalf."}],"context.systemic_exposure":[{"source_index":1,"quote":"The standalone OpenCode app and CLI tool itself were not compromised, the company says; the hole was in the Console, a system it was already in the process of decommissioning."}],"event.summary":[{"source_index":0,"quote":"OpenCode has told customers a “large-scale distillation attack” compromised 1.4% of Console users, with stolen keys being used to rack up unauthorised charges."},{"source_index":1,"quote":"OpenCode confirmed this week that an unauthorized party broke into a legacy version of its Console, the hosted dashboard where some users stored API keys for OpenAI, Anthropic and Google."}]},"notes_on_gaps":"Single press source; no primary disclosure, regulator or court filing. The source conflates two stories: a DeepSeek V4.1-Flash release note and an OpenCode Console credential compromise, plus a separate MONST3R-AI criminal tool. The system that was compromised (OpenCode Console) is not the DeepSeek model described, so system.model_name/version/developer/tools_granted are cited from the DeepSeek release sentences and may not describe the affected system; no source states the OpenCode Console model or harness. event.root_cause=integration is grade D: the source does not name a permission, scope or wiring error, only that a distillation attack compromised users. event.trigger=credential_exposure rests on the stolen-keys sentence. No source states date_occurred, detection method, who noticed, duration, containment, remediation, loss figure, affected count beyond the 1.4% percentage, country, industry, or autonomy arrangement. impact.severity=moderate is grade D: no dollar figure and no explicit bounded-scope statement beyond the 1.4% share. event.agent_involved=true rests on the MONST3R-AI tool sentence, which describes a separate criminal tool, not necessarily the OpenCode compromise. system.tier: not set; no operator named and deployment_context is not a lab's. event.summary: carried from record_version 1; no stored answer supports a value. [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-18] system.autonomy_level: no source states the arrangement. system.deployment_context: no source states where it ran. event.incident_class: a source states an attacker, an injected instruction or a misused credential caused the system to act, or that the system's own boundary (sandbox, permissions, weights, accounts) was breached. event.detection_method: no source says who first noticed. event.summary: classified from described behaviour. context.denominator_available: no denominator is available for this incident. context.country: no source states the operator's location. Merged with LR-2026-0230, which described the same incident; their sources are included here. [corrected by Srini Iyer, approved 2026-10-20 in the corrections review: duplicate of another record, merged] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: a value cited to a sentence about a different event or company was cleared; citations to sentences about a different event were removed; summary or story described a different event or the article, not this event] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: a judgement inferred by us that no source states was cleared]"},"context":{"industry":"Software / AI coding tools","org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":false,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"OpenCode's hosted Console was a dashboard where some users stored API keys for OpenAI, Anthropic and Google so the open-source coding agent could reach those models.","quote":"OpenCode confirmed this week that an unauthorized party broke into a legacy version of its Console, the hosted dashboard where some users stored API keys for OpenAI, Anthropic and Google.","source_index":1,"grade":"D"},{"step":"went_wrong","text":"A large-scale distillation attack compromised Console users' keys, and the stolen keys were used to rack up unauthorised charges on the victims' accounts.","quote":"OpenCode has told customers a “large-scale distillation attack” compromised 1.4% of Console users, with stolen keys being used to rack up unauthorised charges.","source_index":0,"grade":"D"},{"step":"reached","text":"The compromise reached 1.4% of OpenCode Console users, whose credentials were exposed and then used for unauthorised charges.","quote":"OpenCode has told customers a “large-scale distillation attack” compromised 1.4% of Console users, with stolen keys being used to rack up unauthorised charges.","source_index":0,"grade":"D"},{"step":"done","text":"OpenCode told customers about the compromise; no containment or control change is stated.","quote":"OpenCode has told customers a “large-scale distillation attack” compromised 1.4% of Console users, with stolen keys being used to rack up unauthorised charges.","source_index":0,"grade":"D"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-18","source_urls":["https://agenticaihype.substack.com/p/deepseek-gives-away-a-552b-beast"]}}