OpenCode Got Hacked BADLY ( Explained! )

On October 17, 2026, OpenCode said a breach of a legacy Console system exposed API keys that 1.4% of Console users had saved for OpenAI, Anthropic and Google. By morning, people were finding hundreds or thousands of dollars of charges they never made. This video covers: - what OpenCode Console is, and why the local OpenCode app was not part of the breach - the timeline of October 17, hour by hour, from the first bills to the official post - what "distillation" means, and why OpenCode used that word - Anthropic's fight against distillation this year, and why stolen keys are now worth more - who pays: the reported losses, refunds, and what OpenCode and Anthropic said - what to check tonight if you ever saved a key in an app All dollar amounts in the video come from the victims' own posts. Sources: - OpenCode statement on X: https://x.com/opencode/status/2111519637049319818 - Dax Raad on X: https://x.com/thdxr/status/2111528031072461114 and https://x.com/thdxr/status/2111608620441817449 - Colin Parsons on X: https://x.com/colinparsonscom/status/2111451256426250580 - Chris Sinco on X: https://x.com/csinco/status/2111466173762334790 - Matt Johansen on X: https://x.com/mattjay/status/2111480005435719885 - Max Weinbach on X: https://x.com/mweinbach/status/2111518053662064829 - Lydia Hallie (Anthropic) on X: https://x.com/lydiahallie/status/2111563956666110287 - Nathan Lambert on X: https://x.com/natolambert/status/2111549984373911572 - TestingCatalog on X: https://x.com/testingcatalog/status/2111536604351246541 - Hacker News thread: https://news.ycombinator.com/item?id=50133401 - OpenCode Console docs: https://opencode.ai/v2/docs/console/providers - Anthropic, Strengthening our defenses against distillation attacks (Oct 12, 2026): https://www.anthropic.com/research/distillation-defenses - Anthropic, Detecting and preventing distillation attacks (Feb 23, 2026): https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks - Anthropic threat intelligence report, September 2026: https://www.anthropic.com/threat-intelligence-report-september-2026 - CISA/NSA/FBI advisory AA26-251A: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a ## Chapters 0:00 $281 on a key, overnight 0:56 What OpenCode Console is 1:59 October 17, hour by hour 3:47 Why steal API keys 6:22 Who pays 7:51 What to check now 9:01 A whole new world