It triggers me when these companies think that users are fool. I would have appreciated them, if they have disclosed things more transparently.

"mass distillation campaign" there's no public evidence of this. I wonder what OpenCode/Anomaly has, would be an interesting postmortem.

They do have Anthropic and OpenAi as vendors, who are at the center of this hack as well, and who have been beating the "distillation attack" drum on a regular basis.

OpenCode, and the lot, will need to release an open, public, dataset containing the original queries (and other relevant details) that the hacked keys were used for. I'm unwilling to trust those industry players at their word. We need to do our own community analyses.

Obviously they don't want to share details because it's ongoing

If OpenCode is not releasing all of the details about the exposure at the moment, it likely would be a good idea to rotation keys for the connected services at this point

Yes

We don't yet know what the hacked api keys were used for. We would need grand transparency, like an open dataset with the original queries, so that the public can validate through a collaborative effort. I'm not keen to accept their early conclusions, eventual RCA summary stats, or METR reports.