Rendered at 16:33:58 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
cdurth 1 hours ago [-]
So a breach occurs and they recommend people rotate keys? But they claim fraud and break everyone's access with existing keys?
Why anyone uses their services, or even the harness product at this point is beyond me. They just shill cheap and crappy models for training and make boneheaded decisions and "mistakes".
verdverm 1 hours ago [-]
What other open source harnesses are there which have a good, albeit opinionated, experience out-of-the-box?
The $10/40 monthly subscriptions are a great deal. Don't proxy your subs through any one vendor, own your keys, because this is just one of many such events.
unrented7977 8 minutes ago [-]
Oh-my-pi
13 minutes ago [-]
qsod 23 minutes ago [-]
[dead]
nl 7 hours ago [-]
> We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
> We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
Further:
> Third party keys saved in your workspace may have been exposed
Does anyone understand why they are calling this a distillation attack?
duhhhhh1212 7 hours ago [-]
> Does anyone understand why they are calling this a distillation attack?
They think their customers reading that post are idiots so it's easy to convince them of the distillation boogeyman instead of owning the breach.
vikramkr 4 hours ago [-]
The first sentence of the link is "We had a security breach." For distillation is just like saying it was a ransomware attack or similar - the attackers had a motivation. Are they supposed to not explain what happened? This is also one of the go to harnesses for using open source models with and a huge part of usership for them is that. Kind of the exact opposite incentives to Anthropic and co here.
smileybarry 2 hours ago [-]
The low percentage combined with "distillation attack" makes it sound like it was a few scattered requests across a bunch of attacks, and not the hundreds of dollars in third-party usage billed to random users. There's countless reports of OpenCode users impacted by this who woke up to $300-$1700 bills from Anthropic and OpenAI, but OpenCode didn't mention this or offer to compensate users. (Compensation can still come later of course but it's still worth noting right now)
Macha 4 hours ago [-]
I guess that was what they believe the attacker intended to use the stolen keys for?
verdverm 1 hours ago [-]
Narrative shaping is probably more accurate than guess or understand. Do note that the other Ai vendors involved have been chanting the distillation song for a while.
verdverm 3 hours ago [-]
The vendor keys compromised in this, Ant/Oai, have been beating the "distillation attack" drum this year. They have provided no evidence, they need to provide an open dataset with queries and other data so that we can analyze and decide for ourselves. These companies are not trustworthy.
Why anyone uses their services, or even the harness product at this point is beyond me. They just shill cheap and crappy models for training and make boneheaded decisions and "mistakes".
The $10/40 monthly subscriptions are a great deal. Don't proxy your subs through any one vendor, own your keys, because this is just one of many such events.
> We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
Further:
> Third party keys saved in your workspace may have been exposed
https://x.com/WispyWinter/status/2111542806099722698/photo/1
Does anyone understand why they are calling this a distillation attack?
They think their customers reading that post are idiots so it's easy to convince them of the distillation boogeyman instead of owning the breach.