Summary
OpenCode, the popular open-source alternative to Claude Code, has disclosed a security breach that it links to a large-scale distillation attack. This video from David Ondrej explains what happened, who may be affected, and what developers can do about it.
According to the OpenCode account, the incident affected 1.4% of OpenCode console users, a small share of a user base in the millions. Affected users reported unexpected API charges ranging from roughly $168 to $1,700 overnight, tied to bring-your-own keys for OpenAI, Anthropic, and Google. The video explains that attackers reached a legacy system that was being wound down, then used the captured keys to pull outputs from top models to train their own. Distillation attacks were previously aimed at the big labs, and this is presented as the first at scale to target ordinary users’ keys.
The second half focuses on defense. The host cites A16Z data on rising high and critical vulnerabilities and the finding that nearly 90% of exploited CVEs are hit on or before disclosure day, then demonstrates running agentic security loops in the cloud and on a MacBook, including general security sweeps and dependency checks, so developers can protect their own projects.
📺 Source: David Ondrej · Published October 18, 2026
🏷️ Format: News Analysis
