Last week a penetration-testing colleague sent me a screenshot and asked a question that stopped me cold: "If you can buy the intelligence by the token, why would you ever buy the model?"
The screenshot was a Crypto Briefing item โ a blockchain outlet, oddly โ reporting that OpenCode had disclosed a distillation attack affecting 1.4% of its Console users. Two facts. No timeline. No attack vector. No confirmation of whether user data moved or only model outputs. Signal in the noise, except the noise was almost total.
That's the thing about consolidation markets. Chop is for positioning. And the most valuable positioning right now isn't in the charts โ it's in who owns the distinction between stealing a model and renting one until it's yours.
Context: this attack is not new, only the economics are
Model extraction was systematized in 2019, when Tramรจr and colleagues demonstrated that you could query a hosted model and reconstruct its decision boundary using nothing but the API. Nobody cared much, because the models were cheap and the copies were worse.
Then the pricing curve inverted. GPT-class inference dropped by an order of magnitude while the knowledge embedded in those outputs kept compounding. Distillation tooling matured in parallel โ LLaMA-Factory, Unsloth, a dozen fine-tuning stacks that will happily ingest a million (prompt, response) pairs and hand you a smaller model that performs at 85% of the teacher on narrow tasks for 5% of the inference cost.
I audited whitepapers during the 2017 ICO cycle, back when "proprietary technology" meant a GitHub repo with a promise in the README. The parallel is uncomfortable and precise: the moment arbitrage between input cost and output value became wide enough, extraction stopped being a research curiosity and became a business plan.
OpenCode's disclosure is the first time a platform has put a number on it publicly. That number โ 1.4% โ is the entire story.
Core: what 1.4% tells you if you read it like an incident report
Do the arithmetic. If Console accounts sit in the low hundreds of thousands, 1.4% is roughly 1,400 accounts. If it's a million, 14,000. Neither figure is achievable by a curious teenager with a for-loop. Both require three things simultaneously: an account pool, automated scheduling, and distributed sourcing. That is infrastructure. That is a funded operation with a roadmap.
The victims being Console users โ not free-tier API callers โ is the detail everyone will skim past and shouldn't. Console is the developer-facing surface: key management, usage dashboards, billing. Reaching that layer means one of two things, and the article's silence on which is the single most damning thing about it.
Either attackers registered and controlled legitimate Console accounts at scale โ a risk-control failure โ or they stole credentials from real developers โ a credential-security failure. Those are categorically different incidents with different regulatory exposure. A platform that can quantify the blast radius to 1.4% almost certainly knows which one it was. The disclosure chose not to say.
Here is where my audit instincts override my optimism. There is a ladder in this attack, and the media only reported the top rung. The sequence runs: obtain Console access โ harvest or abuse API keys โ bulk-call the API โ collect sample pairs โ distill. Distillation is the last step. Everything before it is a credential compromise, and credential compromises carry obligations that model-copying does not.
If attackers touched Console history โ session logs, stored prompts, key records โ then 1.4% is not a model-theft statistic. It's a data-breach statistic. Under GDPR, that opens a seventy-two-hour notification window. Under a growing stack of state-level statutes, it opens more. The gap between "our model was studied" and "your developers' keys were exposed" is one order of magnitude in severity and roughly a hundred in legal cost.
What OpenCode got right is worth stating plainly, because the coverage buried it. A platform that can measure abuse down to 1.4% has clustering and behavioral analytics already in production. Plenty of AI companies could not tell you whether 1.4% or 41% of their traffic was artificial. The precision is not a concession โ it is a competence signal that the reporting misread as an admission.
What it got wrong is the disclosure discipline. Being scooped by a crypto vertical rather than owning the narrative from an official channel is a crisis-management failure regardless of how good the forensics were. Follow the protocol, not the influencer โ and here the protocol was bypassed.
Contrarian: the real victim isn't the model, and the real threat isn't the competitor
The consensus read will be "competitor stole OpenCode's model." I think that framing is mostly wrong, and dangerously so, because it points defenses in the wrong direction.
Consider the attacker's actual return. A distilled clone of a mid-tier model, trained in a few weeks on a few tens of thousands of dollars of compute, competes on price โ which means the attacker enters a market where price competition is already brutal and margins are compressing toward zero. The extraction was expensive. The product is a commodity. That is not a good business unless the attacker was never selling the model in the first place.
So ask the other question. Who buys a harvested dataset of a competitor's best outputs? The answer is anyone building an evaluation suite, anyone training a vertical agent, anyone who wants to know exactly what a rival does well before shipping. The dataset is the asset. The distilled model is a byproduct.
Which means the correct defense is not "protect the weights." The weights were never exposed โ this is an API platform. The correct defense is output-side telemetry: detecting the fingerprint of structured extraction (repeated system prompts, thermodynamically implausible query distributions, account clusters that light up together), plus key-scope minimization so that a compromised Console credential cannot reach the billing layer it has no business reading.
And there's a second contrarian point the coverage will miss entirely. Most AI platforms' terms of service already forbid training competitors on their outputs. OpenAI has it. Anthropic has it. Every serious player has it. The existence of that clause across the entire industry is proof that everyone knows this attack is live and that the clause is not a defense. A clause is a legal remedy. It is not a control. Confusing the two is how platforms end up writing angrier terms of service while their output distribution walks out the door.
There's a darker possibility that no one is pricing: if the attacker was a competitor rather than criminal infrastructure, this stops being a security incident and becomes commercial espionage โ a different category with different remedies, different PR consequences, and, potentially, different insurance treatment.
The blind spot is that we keep debating whether distillation is theft while the underlying economics quietly declare it rational. Thirty thousand dollars of API calls and a rented GPU cluster will reproduce a meaningful fraction of a frontier model's narrow-task behavior. Until output-side defenses make that math unprofitable, no amount of ToS language changes the incentive.
History repeats, but the code evolves. The 2017 ICO wave taught the market that narrative outruns utility. The 2022 collapse taught it that trustless systems still concentrate trust somewhere. This one is teaching the third lesson: in an API economy, the product and the asset are no longer the same thing, and most platforms are still guarding the wrong one.
The 1.4% is not the story. The story is how many other platforms are sitting on an identical number and have no way to measure it.
When the next disclosure lands โ and it will โ read it for what it says about the credential layer, not the model layer. That's where the damage lives.