While the industry was still arguing about which Layer 2 would win the liquidity war, a quieter event slipped through the feed with almost no coverage. OpenCode disclosed that it had detected a distillation attack originating from its Console user base. The affected cohort was 1.4% of Console accounts. That is it. Two facts, no timeline, no payload inventory, no statement on whether user data ever left the perimeter. Crypto Briefing carried it, which is itself a signal — a pure AI security disclosure dropped into a blockchain vertical suggests the story traveled through a channel that neither understands nor interrogates the mechanism.
Here is what the number actually means, and why the framing around it is wrong.
Context: what a Console account is worth
A Console account is not an end-user login. It is the developer surface. It holds API keys, usage meters, billing state, and often the historical prompt and completion logs that a team keeps for evaluation and audit. When a disclosure says the attack originated from Console users, the implication is not that a chat interface was scraped. It is that the credentialed layer of the platform was used as extraction infrastructure.
This distinction matters because the economics of LLM API platforms are broken in a specific, structural way. The marginal cost of producing one additional completion is near zero relative to the fixed cost of training the model, but the informational value of that completion is enormous. Every (prompt, response) pair is a supervised training sample. A competitor does not need your weights. They need enough of your input-output distribution to fine-tune a smaller model into approximate parity on a narrow task set.
Model extraction was formalized in the literature years ago, at the point where researchers demonstrated that you can steal a machine learning model purely through prediction queries. The LLM era reactivated that entire attack class, because the API surface is now a product and the product is the model's behavior. The terms of service at every major lab explicitly forbid using outputs to train competing models. The existence of that clause is not a legal nicety. It is an admission that the technical control is incomplete by design.
Core: the arithmetic of 1.4%
Run the numbers. If OpenCode's Console base sits in the low hundreds of thousands, 1.4% is roughly one to two thousand accounts. If it sits closer to a million, that figure is fourteen thousand. Neither is a hobbyist probing a rate limit for a weekend. Both require three capabilities stacked together: a pool of credentialed accounts, automated scheduling across them, and distributed source infrastructure to avoid pattern clustering. That is a build, not an exploit.
Now layer on the inference cost. Suppose OpenCode's daily inference spend sits at some baseline X. The abusive share consumes roughly 0.014X of compute, none of which converts to revenue, all of which draws on the same GPU capacity that paying customers are queuing for. In a market where capacity is provisioned and priced forward, that is a direct margin write-down booked against a competitor's R&D budget. The distorted reading of this event is that it is a security incident. The accurate reading is that it is a subsidized transfer of research and development from one balance sheet to another.
There is a second-order problem that the disclosure does not address and probably cannot yet. The attack chain has an ordering. Credential acquisition, then volume extraction, then distillation training. The headline names the last link. The first link is where the actual damage lives, and it is invisible in the coverage. If attackers controlled registered Console accounts through farmed identities, this is a risk-control failure. If they compromised legitimate developers' keys and sessions, this is a credential security failure, and the affected users' exposure extends well past model leakage into anomalous billing, key reuse across other services, and whatever historical prompt data sat in that Console. Those are two different severities separated by an order of magnitude, and the disclosure collapses them into one number.
I have made this mistake in my own work and I know exactly what it looks like from the inside. During the Celsius unwind I built a liquidity stress framework across five lending desks, modeling liquidation cascades under a 30% drawdown. The lesson that stuck was not about the drawdown. It was that solvency ratios computed from reported collateral are fiction if the collateral is being rehypothecated somewhere the ratio does not see. The balance sheet looked fine right up until it did not. This disclosure has the same shape. A 1.4% figure looks controlled. It looks like the platform has the situation measured. What it does not tell you is whether the meter is pointed at the right layer of the stack.
There is an upside signal buried in the same sentence. Precision at 1.4% implies behavioral clustering — account-level anomaly detection, invocation pattern analysis, output distribution monitoring. A platform that cannot count its exposure says 'a small number of users.' A platform that says 1.4% has telemetry. That is not nothing. In fact it is the only genuinely reassuring line in the entire story, and it went entirely unremarked.
Contrarian: the moat was never the model
The reflexive conclusion is that OpenCode needs stronger controls and that the industry should be worried. The contrarian conclusion is that this event proves the opposite of what the security narrative suggests — it proves the model is no longer the asset.
If a competitor can reconstruct useful capability from API outputs at a cost in the low tens of thousands of dollars, then model quality has already commoditized at the task level. Open-source distillation tooling is mature, API pricing has collapsed for two straight years, and the barrier that once separated a state-lab espionage operation from a three-person startup has flattened to near zero. Assuming only sophisticated adversaries will attempt extraction is a modeling error. The correct assumption is that every competitor is a candidate extractor, and the defense budget must be sized accordingly.
Which relocates the moat. It is not the weights. It is the auditable guarantee that a platform's outputs are attributable, its usage is metered, its credentials are scoped, and its behavior is reproducible under examination. That is infrastructure, not research. It is a different capital allocation line from model development, and most AI platforms have not yet staffed it.
Here is where my own framing gets uncomfortable. I have spent the last cycle arguing that the next expansion is driven by machine-to-machine transactions — autonomous agents paying autonomous agents, micro-settlements too small for human intermediation. Distillation attacks are the first real instance of that machine economy arriving in adversarial form. An extraction bot is an agent. It optimizes, it schedules, it evades, and it pays for nothing. The infrastructure we are building for agentic payments is the exact infrastructure that makes this attack cheaper. I do not have a clean resolution for that. The people selling agent rails, myself included in the analysis of them, owe an honest accounting of the fact that the first scaled non-human economic actor on these rails is a thief.
Takeaway
The disclosure question that matters is not how many accounts were touched. It is whether the credentials layer was compromised, whether the platform can prove it was not, and whether the response was measured in hours or discovered in a press cycle. If the answers arrive in two weeks with forensic backing, OpenCode converts a security event into a positioning advantage in a market that has no established standard for this class of disclosure. If they arrive in two months, or never, the narrative hardens around a platform that was used and did not notice.
Watch the firms that say nothing. Every model provider on the market has the same exposure profile, and precisely one has spoken. The distribution of silence is the real signal, and it will not stay quiet for a full quarter.