Unverified50% confidenceFactExact time
OpenCode explained that the attackers do not directly register new accounts; instead they first steal a batch of "clean" accounts with an existing history of trust, then use these accounts to launch distillation requests, so an attack can persist for a period before being detected and banned.
1
Sources
50%
Confidence
Long-term
Relevance
10/24/2026
First Seen
Sources
OpenCode Hit by Large-Scale Attack: Distillation Attacks and the New AI Security Tax
youtubeThe PrimeTime10/24/2026
Related Entities
Related Claims
UnverifiedOpenAI's Session Tokens typically have a long validity period, and once leaked, attackers can continuously control the account for an extended time.78% similarUnverifiedOpenCode has not yet disclosed how the attackers gained system access, how the keys were stored, or the full scope of the key misuse; the company only said the situation is still active.73% similarUnverified攻击者获取refresh_token后即可持续刷新获得新访问权限，即便用户修改密码，已泄露Token在过期前仍可被持续滥用，这称为会话劫持73% similarUnverifiedWhen a maintainer's account is compromised, attackers may plant malicious code in the project and distribute it to all downstream users through subsequent updates.73% similarVerifiedAttackers can exploit stolen AI service account credentials to call API interfaces for computing power theft, and such behavior has frequently appeared in terms-of-service violation reports on platforms such as OpenAI and Anthropic.72% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1092632API
curl https://kongchang.com/api/v1/knowledge/claims/1092632MCP
get_claim(id=1092632)