OpenCode Breach Puts Spotlight on AI Distillation Threats

Executives with the popular OpenCode open-source coding agent are warning users of its Console web-based management hub that third-party API keys from the likes of OpenAI, Anthropic, and Google saved in some workspace may have been exposed in a distillation attack, a technique that Anthropic has warned users about since early this year.

OpenCode confirmed the attack in a post on X, saying that the “large-scale” distillation attack affected about 1.4% of its Console users, all of whom were contacted over the weekend. In another notice, affected developers were urged to revoke and replace the keys, update applications that have been using them, and check the use of those keys for “unexpected activity.”

According to the notice, the attackers gained unauthorized access to a legacy system that OpenCode said it was in the process of decommissioning.

Anomaly Innovations, which builds OpenCode, reportedly also confirmed the attack but said it couldn’t confirm whether the exposed keys had been used for malicious purposes or that data had leaked.

Developers Respond

Developers can use OpenCode as an alternative to vendor-developed coding tools like Claude Code and Cursor, plugging in any model, including those from the likes of OpenAI, Anthropic, Google, and DeepSeek. It also doesn’t store code or context data. It reportedly has more than 214,000 GitHub stars and between 7.5 million and 13 million monthly users. OpenCode Console is an optional web-based management hub that complements OpenCode.

Not surprisingly, the notice announcing the attack has generated concern and questions in the developer communities on such sites as Reddit and X about the nature of distillation attacks and possible fallout from the breach. Dax Raad, a SourceCode co-founder, posted on X that his personal accounts were being attacked. Some users posted that they had seen usage charges from OpenAI and Anthropic on their bills, with one on Reddit saying they got a $150 charge from OpenAI.

The Growing Threat from China

The illicit model distillation is not new. The technique has been used since at least the mid-2010s with machine learning systems, according to the Cloud Security Alliance (CSA), but has been applied to modern AI models since at least 2024 and is gaining traction. 

In a blog post in February, Anthropic researchers wrote that distillation “involves training a less capable model on the outputs of a stronger one.” Distillation is a legitimate tool that can be used by frontier AI labs that take the output from their own models to create other versions.

“But distillation can also be used for illicit purposes: competitors can use it to acquire powerful capabilities from other labs in a fraction of the time, and at a fraction of the cost, that it would take to develop them independently,” they wrote.

At the time, they pointed to “industrial-scale” campaigns being run by three China-based AI companies – DeepSeek, Moonshot, and MiniMax – to grab capabilities from Anthropic’s Claude model to improve their own. According to Anthropic, the three vendors generated more than 16 exchanges with Claude via about 24,000 fraudulent accounts, adding that such activity violated Anthropic’s terms of service and regional access restrictions.

National Security at Issue

Such practices can become a national security problem, the researchers wrote. The models of many U.S.-based AI vendors include features that prevent nation-state and other bad actors from developing dangerous weapons or running cybercrime campaigns, but models created from illicit distillation likely don’t keep such protections, Anthropic researchers wrote.

In June, Anthropic sent a letter to Congress accusing Alibaba of a significant distillation attack against the company. CNBC, which saw the letter, said Alibaba and its AI lab created 28.2 million exchanges with Anthropic models using about 25,000 fraudulent accounts between April and early June.

Government Agencies Weigh In

In September, the National Security Agency (NSA), CISA, and the FBI issued an advisory accusing six Chinese AI labs – DeepSeek, Moonshot, Alibaba, MiniMax, StepFun, and Z.ai – of “industrial-scale knowledge distillation campaigns” against U.S.-based frontier companies, including OpenAI, Anthropic, Google, and xAI, by extracting billions of tokens.

Earlier this month, the AI vendor outlined a range of steps it had taken to combat such distillation attempts, with early numbers indicating that the amount of data harvested by those behind such activity was reduced by 90% to 99%.

“The joint NSA-CISA-FBI advisory on China-based AI distillation campaigns represents a formal government ratification of a threat pattern the AI industry itself had already spent roughly seven months documenting, escalating, and beginning to defend against,” the CSA wrote. “Its principal contribution is not new factual discovery but categorical reframing: by issuing the assessment as a joint interagency advisory structured around an established adversarial machine learning threat framework, the U.S. government has moved industrial-scale model distillation from the category of commercial dispute into the category of national security concern.”