Anomaly Innovations says a distillation attack hit 1.4% of OpenCode Console users with external providers linked, and emailed those affected the next morning while saying the incident is ongoing and withholding further scope details.

A one paragraph X post is standing in for a security disclosure, and the paragraph spends more words on which AI labs it's working with than on what was actually taken.

Anomaly Innovations builds the open-source coding agent OpenCode. Early Friday the company posted on X that it had suffered "a security breach last night related to a large scale distillation attack" affecting 1.4% of OpenCode Console users. It said it notified every affected user by email that same morning. Only a subset of users were touched at all, specifically those who had linked external providers to their accounts. Anyone who didn't get an email, the post says, wasn't impacted.

That's the entire factual record so far. No timeline beyond "last night." No explanation of what a distillation attack against a developer console actually extracted: model outputs, usage logs, or the API keys those external providers require. No total user count to translate 1.4% into an actual number of exposed accounts. Anomaly's own line is blunt about the gap: "The incident is ongoing so we cannot share more details at this point."

What the post does include, in the same breath as that admission, is a list of names: "we are working with Anthropic, OpenAI, and Google to remediate." Three of the most recognizable brands in AI, invoked in a disclosure that otherwise tells users almost nothing they can act on.

Read the post as a security bulletin and it's thin. Read it as a piece of crisis messaging and it's doing real work. Naming Anthropic, OpenAI, and Google signals that the biggest labs in the industry are standing behind the cleanup, which is a reasonable thing to want a reader to feel after "breach" appears in the first sentence. But standing behind a cleanup and explaining what was actually compromised are two different disclosures. Only one of them showed up here.

White House restores UK access to frontier AI models after 17 day freeze

Anthropic kept Claude Mythos 5.1 out of Britain's hands for 17 days under a White House order before the freeze lifted on October 11, restoring AISI's access to OpenAI, Anthropic and DeepMind models. - White House reverses UK AI model access freeze - frontier AI model safety testing restrictions lifted

The timing detail matters too. Anomaly says it emailed affected users the morning after the breach. That sounds fast and responsible. It's also the fastest way to control the narrative before anyone outside the company has independently confirmed scope. A same-day notification with no public detail beyond a headline percentage isn't transparency, it's a holding pattern dressed up as one.

There's also the matter of who qualifies as "affected" at all. Anomaly's post draws a sharp line: only users with external providers linked were touched, and 1.4% of Console users is the total blast radius. That's a specific, checkable-sounding number, which is exactly what makes it worth scrutinizing rather than taking at face value. A precise percentage with no denominator attached: no total Console user count, no description of how "distillation attack" translates into what an attacker actually walked away with. That reads less like forensic clarity and more like a figure chosen because it sounds small.

Anomaly, formerly known as SST, has had security problems in public before. OpenCode shipped with an unauthenticated local HTTP server that let any process on a machine execute shell commands with the user's privileges. That flaw, tracked as CVE-2026-22812, was patched in version 1.0.216 after reports from the Datadog Security Labs newsletter and vulnerability trackers including the NVD. A second flaw, CVE-2026-22813, let a malicious website hijack OpenCode's web UI through unsanitized HTML rendering of LLM output and run arbitrary commands via the tool's own terminal endpoints, patched in version 1.1.10. Neither CVE involved a breach of Anomaly's own servers. This one, by the company's own description, did.

Distillation attacks aren't new to the AI labs Anomaly says it's now working with. OpenAI disrupted a campaign earlier this year in which a cluster tied to Moonshot AI's Kimi sent more than 16,000 requests across 4,000-plus accounts trying to extract OpenAI's encrypted chain-of-thought reasoning. OpenAI said that pattern ultimately touched more than 15,000 user accounts without breaking its encryption or exposing stored conversations. If something similar happened through OpenCode Console, the obvious next question is which model providers' outputs were being siphoned, and through whose credentials. Anomaly hasn't said.

Frankly, a company that can name three AI labs by name in a crisis post can find a sentence to say what data left the building. Until it does, the most honest reading of Friday's post isn't a security update. It's a statement engineered to make "breach" sound survivable before the details that would actually let users judge that for themselves ever arrive.

This article is posted in Technology News, check it out for more related stories.

Join the discussion

Open in the community →

Almost there. Sign in and your reply posts straight away.

OpenCode's breach note names Anthropic and OpenAI before it names the damage - Startup Fortune