Net Good IndexSubmit a correction

Harm Ledger · provisional · Safety

OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respond - Step Security

OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respond  Step Security

Tier 2 Significant HarmMethodology 0.2
Submit a correction

Current score

−0.12

3 base · Significant Harm (tier 2 of 5, 3 pts)
× 0.5000 attribution · Material acceleration
× 0.3500 evidence · Technical disclosure or preprint
× 0.5500 realization · Experimentally validated
× 0.4000 durability · Temporary or quickly replaceable
Event-level product before credit split: 0.12

Ingest update: independent source raised evidence; added a follow-up source. Score remains provisional until review. Follow-up ingest: independent source raised evidence; added a follow-up source.

What happened

OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respond  Step Security Update (2026-10-19): OpenCode Console Breach Exposes OpenAI, Anthropic, and Google API Keys in Credential Theft and Distillation Attack (October 2026) - Rescana. OpenCode Console Breach Exposes OpenAI, Anthropic, and Google API Keys in Credential Theft and Distillation Attack (October 2026)  Rescana Update (2026-10-20): OpenCode breach let hackers burn users' AI credits for model theft - Startup Fortune. OpenCode breach let hackers burn users' AI credits for model theft  Startup Fortune

Model attribution

Unspecified AI system
Version unspecified
−0.12

Unspecified

Unspecified system mentioned or implied by a news item. Remap to a named release when identified.

News ingest does not infer a named model from the publisher alone. Attribution stays unspecified until a release is identified.

Attribution 0.5000 · Credit share 100% · Unknown

Claims

  • OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respond - Step Security

    outcome · supported

Sources

primary sources

other sources

Revision history

  • 19 Oct 2026 · 0.00 → 0.05

    Auto-published from news ingest.

  • 19 Oct 2026 · 0.05 → 0.08

    Ingest update: independent source raised evidence; added a follow-up source.

  • 20 Oct 2026 · 0.08 → 0.12

    Ingest update: independent source raised evidence; added a follow-up source.

Submit a correction