OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respond

OpenCode reported a security breach targeting Console users who had linked AI providers to their accounts. The attack involved a distillation attack technique, which likely involved extracting or manipulating AI model outputs or credentials. The breach specifically affected developer environments where OpenCode was installed. StepSecurity published guidance on how to detect OpenCode installations on developer machines and how to respond to the incident. The article provides both vendor-reported information and practical remediation steps for security teams. This incident highlights supply chain and AI integration risks in developer tooling environments.