A precise number is a sedative. When OpenCode disclosed that 1.4% of its Console users were caught in a "distillation attack," it handed the market a figure engineered to be swallowed without chewing. One point four percent. Small enough to feel contained. Specific enough to feel audited. And almost entirely useless as a description of what actually happened.
In my line of work, I have learned to distrust numbers that arrive before the questions do. Precision is not the same as transparency โ it is often the anesthetic that makes transparency unnecessary. The real story here is not the 1.4%. It is everything that number was placed in front of to hide.
Distillation attacks are not new. The academic scaffolding goes back to 2019-2020, when Tramรจr and colleagues formalized "Stealing Machine Learning Models" โ the systematic extraction of a model's behavior through query-response pairs. Back then the target was prediction APIs: image classifiers, spam filters, credit-scoring engines. The attack required millions of queries and produced a functional clone trained on stolen outputs. When LLMs arrived and API pricing collapsed between 2023 and 2025, the economics of that playbook shifted from academic curiosity to rational commerce. The output of a frontier model is now a high-value asset sold at a marginal cost approaching zero. That gap โ between near-zero production cost and high knowledge value โ is the arbitrage that makes model extraction worth organizing.
What makes the OpenCode case worth my attention is not the attack. It is the channel. The disclosure surfaced through Crypto Briefing, a blockchain vertical, reporting a pure AI-platform security event with zero crypto-asset linkage in the body. That is a channel mismatch, and channel mismatches are forensic tells. It means the story was likely relayed, second-hand compiled, or leaked from a community channel before it was ever an official statement. Information decays in transit. By the time a fact reaches a crypto newsletter, the technical substance is usually gone and only the headline survives. So I read this the way I read a token whitepaper in 2017: claim first, then look for the code behind it.
Here is the mechanical problem. A distillation attack at scale is not a lone actor probing an endpoint. To capture enough (prompt, response) pairs to fine-tune a competitive model, you need volume โ sustained, automated, distributed. The 1.4% figure, read correctly, is not a reassurance about containment; it is a confession of industrial-scale infrastructure. If OpenCode's Console base is in the low hundreds of thousands, 1.4% is roughly fourteen hundred accounts. If it is in the millions, it is tens of thousands. Neither number is consistent with casual abuse. Both are consistent with account farms, automated scheduling, and distributed sourcing โ an engineered pipeline, not a curious developer testing a rate limit.
And the victim class is the tell. Console users are not end users. They are developers โ the people who hold API keys, monitor billing, manage quotas. Console is the control plane. If an attack "affected Console users," there are exactly two possible paths, and the disclosure did not distinguish between them. Path one: the attacker registered or controlled a large pool of legitimate Console accounts โ a platform risk-control failure. Path two: the attacker compromised legitimate users' API keys or session credentials โ a credential-security failure. These are not the same severity. They are not the same incident. One is a nuisance; the other is a breach. The disclosure's refusal to say which one it was is the most important sentence it never wrote.
This is where my 2017 experience sharpens the read. When I dissected the Status whitepaper for what became "The Vaporware Gap," I built a discipline I still use: Claim vs. Code. You take every assertion and ask what technical artifact would have to exist for it to be true. Applied here: the claim is "a distillation attack affecting 1.4% of Console users." The artifact that would verify it is a forensic timeline โ detection date, containment date, data-touch analysis, notification record. None of that exists in the disclosure. What exists is a number floating without an evidence chain beneath it. Under my framework, that is not a verified fact. It is a marketing artifact wearing the costume of one.
The economics deserve their own paragraph, because this is where the structural risk lives. In 2020, during DeFi Summer, I spent two weeks modeling the lend-to-trade loop โ the way liquidation bots and correlated collateral created cascade risk that no single protocol's dashboard revealed. The lesson was that system fragility hides in the dependencies between components, not inside any one of them. The same logic applies to LLM APIs. The dependency is this: every platform that sells high-quality model output at low marginal cost is, by construction, subsidizing its own extraction. The attacker pays token fees โ or uses stolen credentials to pay nothing โ and walks away with training data that would have cost the platform millions in R&D to produce. Since 2024, open distillation frameworks like LLaMA-Factory and Unsloth have driven the attacker's total cost down to the tens of thousands of dollars. Model extraction has migrated from corporate espionage to a mid-tier competitive tactic. The defense must now assume every competitor is a potential attacker.
That is why the silence around the Console layer matters more than the model layer. If the attacker gained control-plane access, the logical sequence is fixed: steal or farm credentials, then bulk-call the API, then distill. The headline names only the last link โ distillation. The earlier links, credential compromise and possible lateral movement into billing and usage records, are the ones that carry legal weight. Under GDPR, a personal-data breach carries a seventy-two-hour reporting clock. Under the phased EU AI Act, high-risk systems carry event-reporting obligations. If OpenCode sat on internal detection longer than those clocks allow, the omission is not just editorial. It is a compliance exposure. Silence about timing, in a disclosure that is otherwise precise, is itself a data point.
Let me be fair to the one genuinely positive signal buried in the noise. The fact that OpenCode could quantify exposure to a decimal suggests a detection capability already exists โ behavioral clustering, anomaly scoring, usage-pattern analysis. You do not produce "1.4%" from a company that has no idea what hit it. You produce it from a company that can see the shape of the attack. That is a real technical asset, and the disclosure buried it under the number instead of leading with it.
Now the competitive layer, which the crypto-channel framing complicates. If OpenCode serves Web3 developers โ a plausible reading given where the story surfaced โ then its customer base is the most security-sensitive, fastest-propagating audience on the internet. A security event in that ecosystem travels five to ten times faster than in traditional SaaS, and the platform cannot control the narrative. In a market where model capability is converging, "security" is one of the few defensible differentiators. That makes this incident an unguarded attack surface that any competitor's marketing deck can quote verbatim: "1.4% of users affected." The number meant to reassure is the number that will be weaponized.
The valuation read is narrower than the panic suggests. Large AI platforms have all absorbed security events; the market already prices "security incident" as a manageable risk rather than a fatal one. The real question is not whether OpenCode was attacked. It is whether OpenCode demonstrates a system of defense or just a talent for post-hoc disclosure. A company that ships forced key rotation, granular quotas, and a published detection methodology inside a month earns a maturity premium. A company that only issues statements earns a discount. This is a maturity question dressed as a security question.
Here is the counter-intuitive read, the one the bear case demands I state even against my own skepticism. The disclosure itself may be the most valuable thing OpenCode did โ not because it was complete, but because almost no one else does it. The industry norm for AI-platform abuse is silence. Terms of service prohibit training competitors on outputs; the prohibitions exist precisely because the abuse is rampant and largely unreported. A platform that steps forward, even with an incomplete story, occupies a trust position its quieter competitors cannot easily copy. In a market where capability is collapsing into commodity, "the platform that tells you when it is attacked" is a brand asset with a shelf life measured in weeks.
But I will not let the contrarian angle become an apology. The window is thirty days. If OpenCode ships substantive hardening inside it โ forced API-key rotation, usage anomaly alerting, a public methodology โ the community files it as "a company that responds fast." If it goes quiet past thirty days, the narrative calcifies into "the platform that got hit and managed the message." Developer communities have short memories for goodwill and long memories for evasion.
There is a second contrarian point the framing forces me to raise. If OpenCode's model is partially open-weight, the entire "distillation attack" label may be a category error. You cannot steal what is already published; the economics of extraction collapse when a cheaper path exists. In that case the media label is doing damage the incident did not โ conflating "output scraping" with "model theft," and inflating public fear about data exposure that may never have occurred. Media generalization is its own attack surface. It converts a contained incident into a reputational wound the platform did not inflict. The public reads "distillation" and hears "my data leaked." Those are different disasters. Blurring them serves no one but the headline.
So watch the evidence, not the number. The signals that will resolve this are concrete: a forensic timeline with dates, a data-touch determination, a notification record, a hardening release. If those arrive, the 1.4% becomes a footnote in a competent incident response. If they do not, the 1.4% becomes the whole story โ a precise figure deployed to end a conversation that should have just begun. Code is law, but logic is fragile. And a number without an evidence chain is not a fact. It is a claim waiting to be audited. Trust no one. Verify everything โ especially the percentages.