OpenCode disclosed a security incident involving a large-scale "distillation attack" that affected approximately 1.4% of OpenCode Console users. The team notified all impacted accounts via email on the morning of October 18, clarifying that users who did not receive notifications fall outside the scope of this breach. The company confirmed the incident was limited to certain users linked to external service providers. While specific technical details remain undisclosed as remediation efforts continue, OpenCode stated it is actively coordinating with Anthropic, OpenAI, and Google to address the vulnerability and mitigate further risks.