{"data":{"event":{"id":"18b02ad8-da5b-4b34-90c4-9f3c194c5d72","slug":"opencode-security-breach-distillation-attack-hit-console-users-with-link-9c872d77bb","title":"OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respond - Step Security","short_summary":"OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respond  Step Security","full_description":"OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respond  Step Security\n\nUpdate (2026-10-19): OpenCode Console Breach Exposes OpenAI, Anthropic, and Google API Keys in Credential Theft and Distillation Attack (October 2026) - Rescana. OpenCode Console Breach Exposes OpenAI, Anthropic, and Google API Keys in Credential Theft and Distillation Attack (October 2026)  Rescana\n\nUpdate (2026-10-20): OpenCode breach let hackers burn users' AI credits for model theft - Startup Fortune. OpenCode breach let hackers burn users' AI credits for model theft  Startup Fortune","ledger_type":"harm","primary_domain_id":"8b844c0d-c1ac-4f54-920a-34321e45582d","event_status":"provisional","event_date":"2026-10-18T00:00:00.000Z","discovery_date":"2026-10-18T00:00:00.000Z","first_published_date":"2026-10-18T00:00:00.000Z","last_reviewed_date":"2026-10-20T00:00:00.000Z","geographic_scope":"International","affected_population":null,"base_impact_tier":2,"base_score":"3.00","attribution_multiplier":"0.5000","evidence_multiplier":"0.3500","realization_multiplier":"0.5500","durability_multiplier":"0.4000","current_event_score":"0.115500","confidence_level":"low","score_explanation":"Ingest update: independent source raised evidence; added a follow-up source. Score remains provisional until review. Follow-up ingest: independent source raised evidence; added a follow-up source.","methodology_version_id":"8745541b-0f8e-4d5a-9b47-5291d3813a8d","original_methodology_version_id":"8745541b-0f8e-4d5a-9b47-5291d3813a8d","published_at":"2026-10-19T08:01:09.472Z","created_at":"2026-10-19T08:01:09.472Z","updated_at":"2026-10-20T08:01:12.117Z","flags":[],"domain_name":"Safety","domain_slug":"safety","methodology_version":"0.2"},"contributions":[{"id":"ac79b7cf-685d-4374-8e5c-716e64d3bce4","event_id":"18b02ad8-da5b-4b34-90c4-9f3c194c5d72","model_id":"535014f7-c941-4d39-aa9b-8f9c1d3d07b7","role_description":"Unspecified system mentioned or implied by a news item. Remap to a named release when identified.","attribution_multiplier":"0.5000","credit_share":"1.0000","contribution_score":"0.115500","attribution_rationale":"News ingest does not infer a named model from the publisher alone. Attribution stays unspecified until a release is identified.","attribution_confidence":"medium","first_used_date":"2026-10-18T00:00:00.000Z","model_version_if_known":null,"review_status":"approved","created_at":"2026-10-19T08:01:09.504Z","model_slug":"unspecified-ai-system","model_name":"Unspecified AI system","identity_class":"unknown","is_internal":false,"family_name":"Unspecified","family_slug":"unknown-unspecified","organization_name":"Unknown","organization_slug":"unknown"}],"sources":[{"id":"ee11af21-14ef-4286-9970-293f9b890f41","event_id":"18b02ad8-da5b-4b34-90c4-9f3c194c5d72","url":"https://news.google.com/rss/articles/CBMiaEFVX3lxTE5IMDlSVTJTVTQzXzlNNS1zSXFBRm52eFRjcUw1ZWxZcW9NZlhOekM3QUw2WlhYeUttRFlqQWNPeUFPdVBvUENDWmJYT3kySFZnZ2xCZHB3TU5LaWZLeUhSZ1ZDLUJmc3JH?oc=5","canonical_url":"https://news.google.com/rss/articles/CBMiaEFVX3lxTE5IMDlSVTJTVTQzXzlNNS1zSXFBRm52eFRjcUw1ZWxZcW9NZlhOekM3QUw2WlhYeUttRFlqQWNPeUFPdVBvUENDWmJYT3kySFZnZ2xCZHB3TU5LaWZLeUhSZ1ZDLUJmc3JH?oc=5","source_type":"journalism","publisher":"Frontier lab incident news","author":null,"publication_date":"2026-10-18T00:00:00.000Z","retrieved_at":"2026-10-19T08:01:09.528Z","title":"OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respond - Step Security","excerpt":"OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respond  Step Security","content_hash":null,"source_reliability_class":"medium","is_primary_source":true,"is_independent":true,"is_peer_reviewed":false,"archived_url":null,"created_at":"2026-10-19T08:01:09.528Z"},{"id":"86619ad0-5a7c-4afd-aec9-063981267018","event_id":"18b02ad8-da5b-4b34-90c4-9f3c194c5d72","url":"https://news.google.com/rss/articles/CBMi4wFBVV95cUxPeXpxTjhnbllMYVhnUE5BX19XbHlqaGRMYlBLUzNMTEstbDNCeFhRSjJiaTVqbzFXcjV2YTY3WmFTbmFjZlN1QzVZc2FLbHNhZk9NbHRUS0ZkZFVXT19zUTRuZ3E1ZXdEREVvN2dzQ0dSc1R5ZTVmb0lTOXlvYjh5aUVwOHM1M09mMDVVR1FHOVdZV0dzRElHbEdoSDFSSzc5VFdGaG1OOVBmY2F6Wmo2Rm5VWmI2M0pCNGUxcm9QR2VHeUctOURaMlpVMXRZSzNoazAycDBXT3VpeGljYUpkR3lOaw?oc=5","canonical_url":"https://news.google.com/rss/articles/CBMi4wFBVV95cUxPeXpxTjhnbllMYVhnUE5BX19XbHlqaGRMYlBLUzNMTEstbDNCeFhRSjJiaTVqbzFXcjV2YTY3WmFTbmFjZlN1QzVZc2FLbHNhZk9NbHRUS0ZkZFVXT19zUTRuZ3E1ZXdEREVvN2dzQ0dSc1R5ZTVmb0lTOXlvYjh5aUVwOHM1M09mMDVVR1FHOVdZV0dzRElHbEdoSDFSSzc5VFdGaG1OOVBmY2F6Wmo2Rm5VWmI2M0pCNGUxcm9QR2VHeUctOURaMlpVMXRZSzNoazAycDBXT3VpeGljYUpkR3lOaw?oc=5","source_type":"journalism","publisher":"Frontier lab incident news","author":null,"publication_date":"2026-10-19T00:00:00.000Z","retrieved_at":"2026-10-19T08:01:09.750Z","title":"OpenCode Console Breach Exposes OpenAI, Anthropic, and Google API Keys in Credential Theft and Distillation Attack (October 2026) - Rescana","excerpt":"OpenCode Console Breach Exposes OpenAI, Anthropic, and Google API Keys in Credential Theft and Distillation Attack (October 2026)  Rescana","content_hash":null,"source_reliability_class":"medium","is_primary_source":false,"is_independent":false,"is_peer_reviewed":false,"archived_url":null,"created_at":"2026-10-19T08:01:09.750Z"},{"id":"85c3e7aa-27fe-415f-9687-8f3868b6dde3","event_id":"18b02ad8-da5b-4b34-90c4-9f3c194c5d72","url":"https://news.google.com/rss/articles/CBMimAFBVV95cUxQNGZZV0Z2TzJ6clFDLXhoY0diR0lReFhWaVlVcTU1TXlQZkUweTJtRVhHeVY3RnVQSk9GajZXY3pFSWtTNTF0T05nYUdTU1IzaGx2YUlFczR5SnZNYzZqdV9JRlRpTzEzVnFkcVBKSmhIWHVDLXpvZ3V5SDVwSUdzMmFlSHB1R0FsbnRfMURHWFQwTGxGZGd3Zw?oc=5","canonical_url":"https://news.google.com/rss/articles/CBMimAFBVV95cUxQNGZZV0Z2TzJ6clFDLXhoY0diR0lReFhWaVlVcTU1TXlQZkUweTJtRVhHeVY3RnVQSk9GajZXY3pFSWtTNTF0T05nYUdTU1IzaGx2YUlFczR5SnZNYzZqdV9JRlRpTzEzVnFkcVBKSmhIWHVDLXpvZ3V5SDVwSUdzMmFlSHB1R0FsbnRfMURHWFQwTGxGZGd3Zw?oc=5","source_type":"journalism","publisher":"Frontier lab incident news","author":null,"publication_date":"2026-10-20T00:00:00.000Z","retrieved_at":"2026-10-20T08:01:12.059Z","title":"OpenCode breach let hackers burn users' AI credits for model theft - Startup Fortune","excerpt":"OpenCode breach let hackers burn users' AI credits for model theft  Startup Fortune","content_hash":null,"source_reliability_class":"medium","is_primary_source":false,"is_independent":false,"is_peer_reviewed":false,"archived_url":null,"created_at":"2026-10-20T08:01:12.059Z"}],"claims":[{"id":"f546fe6f-9f54-48f2-a01d-e8b061f63188","event_id":"18b02ad8-da5b-4b34-90c4-9f3c194c5d72","claim_text":"OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respond - Step Security","claim_type":"outcome","claim_status":"supported","confidence_score":null,"created_at":"2026-10-19T08:01:09.537Z","updated_at":"2026-10-19T08:01:09.537Z"}],"revisions":[{"id":"844cd359-5f09-4c12-a878-b6cfda314ece","event_id":"18b02ad8-da5b-4b34-90c4-9f3c194c5d72","model_id":null,"previous_score":"0.000000","new_score":"0.049500","previous_factors":{},"new_factors":{"tier":2,"evidence":0.15,"base_score":3,"durability":0.4,"attribution":0.5,"realization":0.55},"change_reason":"Auto-published from news ingest.","trigger_type":"news_ingest","trigger_source_ids":null,"reviewer_id":null,"review_status":"published","created_at":"2026-10-19T08:01:09.553Z"},{"id":"f9dde1b3-038f-4405-a18f-70e4f6cc785e","event_id":"18b02ad8-da5b-4b34-90c4-9f3c194c5d72","model_id":null,"previous_score":"0.049500","new_score":"0.082500","previous_factors":{"tier":2,"evidence":0.15,"base_score":3,"durability":0.4,"attribution":0.5,"realization":0.55},"new_factors":{"tier":2,"models":["535014f7-c941-4d39-aa9b-8f9c1d3d07b7"],"evidence":0.25,"base_score":3,"durability":0.4,"attribution":0.5,"realization":0.55},"change_reason":"Ingest update: independent source raised evidence; added a follow-up source.","trigger_type":"ingest_update","trigger_source_ids":["86619ad0-5a7c-4afd-aec9-063981267018"],"reviewer_id":null,"review_status":"published","created_at":"2026-10-19T08:01:09.773Z"},{"id":"34953505-6545-4578-b7ae-51f97023bdc7","event_id":"18b02ad8-da5b-4b34-90c4-9f3c194c5d72","model_id":null,"previous_score":"0.082500","new_score":"0.115500","previous_factors":{"tier":2,"evidence":0.25,"base_score":3,"durability":0.4,"attribution":0.5,"realization":0.55},"new_factors":{"tier":2,"models":["535014f7-c941-4d39-aa9b-8f9c1d3d07b7"],"evidence":0.35,"base_score":3,"durability":0.4,"attribution":0.5,"realization":0.55},"change_reason":"Ingest update: independent source raised evidence; added a follow-up source.","trigger_type":"ingest_update","trigger_source_ids":["85c3e7aa-27fe-415f-9687-8f3868b6dde3"],"reviewer_id":null,"review_status":"published","created_at":"2026-10-20T08:01:12.157Z"}],"secondary":[]},"methodology_version":"0.1"}