[opencode]

October 20, 2026

• An intruder reached a legacy OpenCode Console system during a large-scale distillation attack. Keys for OpenAI, Anthropic, and Google providers may have been exposed from October 17 at 00:30 UTC; some users reported unauthorized charges as high as $1,700. Co-founder Dax Raad said AI agents had targeted the service for at least 48 hours, and that general models refused parts of the defensive investigation before the team gained access to OpenAI Daybreak. BleepingComputer and The Hacker News · AI & Model Security

in OpenCode’s Distillation Breach Exposes AI Provider Keys

September 7, 2026

• Kimsuky's Operation GitPower is now mass-producing decoys with an AI coding agent: Genians analysed 13 malicious LNK files collected 11–19 August 2026 whose decoy PDF metadata names the open-source agent OpenCode as producer. Lures shifted from diplomacy and academia to finance and corporate operations (fund disbursement, insurance premiums, Visa payments); the LNKs launch PowerShell with encrypted loaders buried in over-long arguments padded with leading spaces, pull decoys and follow-on commands from GitHub Raw using hardcoded PATs, and now add Pastebin as a second-stage channel plus anti-analysis routines that check for virtualization and analysis tooling, inspect sandbox usernames and wipe command history. All 13 share the same decoder constant and array variable name — cheap hunting pivots. · Threat Intelligence

in The Diff Is the Disclosure: MikroTik's Silent Patch Comes Apart