Hook
One point four percent. That's the number OpenCode put on the record when it disclosed a distillation attack against its Console users. Not "a small number." Not "limited impact." A precise, measurable, defensible figure. In a market where most platforms hide behind vague language when their security fails, that precision is itself the story. But here's what the number doesn't tell you: whether the attack succeeded, how long it ran, or whether the credentials of 1.4% of Console users are still sitting in someone else's database right now.
I've been on both sides of this equation. I've watched $400,000 evaporate because I trusted a narrative I hadn't verified on-chain. That tuition payment taught me one thing that applies here with brutal clarity: the moment a platform tells you the size of a breach but not the shape of it, you're looking at damage control, not a security report. The 1.4% is the most transparent thing in the disclosure and the least informative at the same time.
Context
Model distillation attacks aren't new. They've been a documented class of threat since at least 2019, when researchers formalized model extraction as an attack surface. In the LLM era, the economics changed dramatically. API pricing collapsed through 2024 and 2025. Open-source distillation frameworks matured. The barrier to entry for "steal a model by querying it" dropped from seven figures to the low tens of thousands of dollars.
That shift matters because it changed who the attacker is. Distillation is no longer a nation-state operation or a corporate espionage playbook. It's a mid-tier competitive move, accessible to any startup with a bankroll and patience.
The mechanics are simple: flood the API with structured prompts, capture the responses, train a smaller model on the pairs. The victim pays for inference costs on calls that generate zero commercial return. The attacker walks away with a functional approximation of the original model at a fraction of the R&D cost. Both sides of the trade have asymmetric information about the transaction.
OpenCode disclosed this attack through Crypto Briefing, a crypto vertical outlet, with zero apparent connection to crypto assets in the coverage itself. That channel mismatch raises questions. Is OpenCode serving Web3 developers? Did it take crypto-native funding? Or is this simply a second-hand compilation that lost critical details in transit? I've seen how information decays when it moves through non-primary channels. You lose the attack vectors first, then the timelines, then anything that would give you a verifiable picture.
Core
The technical reality of this attack is less about the model and more about the Control Plane. Distillation is the last link in the chain, and the media's focus on it obscures the earlier links that matter more.
The attack sequence looks like this in any serious version: acquire Console access (either through account farm registration or credential theft), establish a distributed calling pattern that evades per-account rate limits, harvest structured prompt-response pairs at scale, then run the actual training on separate compute. Each step is measurable. Each step should have been logged. The question is which step OpenCode's detection system actually caught.
The 1.4% figure is only possible with behavioral clustering capability. To arrive at that precise a number, OpenCode must have run some form of anomaly detection on Console accounts โ shared prompt structures, synchronized call patterns, abnormal token consumption curves. That's a real technical signal. Platforms that have no detection capability don't disclose percentages. They disclose categories. The fact that OpenCode can measure 1.4% means it can see something.
But here's the gap that no one in the coverage addressed: there are two fundamentally different attack paths, and the disclosure doesn't clarify which one occurred.
Path A: An attacker registered thousands of legitimate Console accounts, paid for access, and used them to harvest model outputs. The victim of this attack is OpenCode's revenue stream. Users are fine. The only cost is inference overhead and the loss of training data value.
Path B: An attacker stole credentials or session tokens from legitimate Console users and used those to query the API. The victims here are not just OpenCode โ they are the developers who trusted the platform with their account data. If the attacker had Console-level access, they could see API keys, billing information, usage history, potentially prompt histories depending on how sessions are stored.
These two scenarios differ by an order of magnitude in severity. The first is a commercial threat. The second is a security incident with regulatory implications under GDPR's 72-hour notification window and the EU AI Act's phased incident reporting requirements.
For Console users, the practical question is whether their API keys are compromised and need rotation. There is no part of the public disclosure that answers this. And in a bear market, in a crypto-adjacent developer community that's already paranoid about operational security, that omission is going to hurt.
Contrarian
Everyone is talking about whether OpenCode can recover its security reputation. I think that's the wrong frame.
The real signal in this event isn't an attack. It's that we now have a platform admitting to the attack class at all.
Count the AI platforms that have proactively disclosed distillation attacks. The number is small. Most don't have detection. Those that do treat it as proprietary intelligence they don't want to share, because announcing vulnerability creates attack surfaces that didn't exist in the marketing narrative. OpenCode broke from that pattern.
The precision of "1.4%" makes this worse publicly and better strategically. Worse, because the number can be quoted by competitors out of context โ "1.4% of Console users were affected by an attack" reads as headline material regardless of whether those users were actually harmed. Better, because any attacker now knows OpenCode has monitoring. The 1.4% is a deterrent advertisement.
Here's what I don't hear anyone saying: if OpenCode is truly capable of this level of detection, why didn't it stop the attack earlier? The 1.4% figure suggests a detection window that either captured an ongoing pattern or a completed one. Which is it? Because if the attack ran for weeks before detection, the 1.4% number becomes a statement about how long it took to notice, not how well the platform defended. That distinction is everything.
And on the crypto angle: if OpenCode truly serves a Web3 developer audience, its security failure will spread faster and harder through Telegram and Discord than through any conventional SaaS channel. Crypto-native developers don't forgive operational security failures the way enterprise procurement teams do. They simply migrate.
Takeaway
Watch three signals over the next thirty days. First, whether OpenCode publishes a detailed post-mortem with attack timeline and root-cause analysis. A disclosure without a post-mortem is a press release. Second, whether any user reports forced API key rotation or unexpected billing โ that tells you whether Path A or Path B actually occurred. Third, whether the next earnings or funding announcement for OpenCode gets delayed. Because in a market this tight, a security event that erodes developer trust and slows enterprise sales cycles shows up in the pipeline, not in the disclosure.
The broader bet I'm making: by 2027, "model output protection" will be a standard product category alongside WAF and IDS. The platforms that treat distillation as a competitive threat today will sell anti-distillation services tomorrow. OpenCode just paid the entry fee. The question is whether it uses the receipt.