OpenCode reports a security breach affecting 1.4% of Console users

OpenCode, the open-source coding agent, posted on X that it "had a security breach last night related to a large scale distillation attack" that affected 1.4% of OpenCode Console users. This is OpenCode's own account; it has given no further detail.

• It says it notified affected users by email. In an edited version of the post it adds that anyone without an email was not affected, and that the affected users were a subset who had external providers linked.
• It says the incident is ongoing, so it cannot share more, and that it is working with Anthropic, OpenAI and Google to remediate.
• The Hacker News headline says credentials were leaked. The post does not say that. Replies on X from users report lost money (one says $138), and none of these reports is confirmed.