Yet another Hacker News

OpenCode has a security breach last that impacted 1.4% of console users

8 points notmine1337 5 hours ago 7 comments

nl 3 hours ago | parent

> We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users

> We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked

Further:

> Third party keys saved in your workspace may have been exposed

https://x.com/WispyWinter/status/2111542806099722698/photo/1

Does anyone understand why they are calling this a distillation attack?

duhhhhh1212 3 hours ago | parent

> Does anyone understand why they are calling this a distillation attack?

They think their customers reading that post are idiots so it's easy to convince them of the distillation boogeyman instead of owning the breach.

vikramkr 55 minutes ago | parent

The first sentence of the link is "We had a security breach." For distillation is just like saying it was a ransomware attack or similar - the attackers had a motivation. Are they supposed to not explain what happened? This is also one of the go to harnesses for using open source models with and a huge part of usership for them is that. Kind of the exact opposite incentives to Anthropic and co here.

Macha 1 hour ago | parent

I guess that was what they believe the attacker intended to use the stolen keys for?

verdverm 18 minutes ago | parent

The vendor keys compromised in this, Ant/Oai, have been beating the "distillation attack" drum this year. They have provided no evidence, they need to provide an open dataset with queries and other data so that we can analyze and decide for ourselves. These companies are not trustworthy.

anygivnthursday 47 minutes ago | parent

Also discussed earlier here: https://news.ycombinator.com/item?id=50133401

verdverm 19 minutes ago | parent

With almost 900 upvotes