AI agents 2026 run on APIs — and in October 2026 we learned what a determined thief does with one. Between October 17 and 20, 2026, OpenCode was hit by what it described as a large-scale distillation attack: a 48-hour bombardment of requests designed to harvest the model's behaviour, which exposed 1.4% of Console workspaces. The attacker did not break in. They just asked — systematically, at scale, through the front door. If you operate a model API, an agent gateway, or resell model access, the honest question is whether the same pattern is sitting in your logs right now. This page checks.
The short answer: distillation is visible in per-key log patterns, not in totals. A distilling key sweeps many topics, clusters near-identical prompt lengths, walks parameters up in a staircase, fires at machine-regular intervals, and may share prompt prefixes across keys. Paste your JSONL gateway logs below and get a per-key verdict — CLEAN, WATCH or DISTILLATION-SUSPECT — with every fired signal named.
🔒 Your logs NEVER leave your browser. This checker is pure client-side JavaScript with no network calls: paste, analysis and verdicts all happen on this device. Nothing is uploaded, stored or transmitted anywhere. The preloaded log below is synthetic sample data invented for this page — it contains no real keys, users or traffic.
A model distillation attack is the systematic extraction of a model's behaviour through its normal API: an attacker sends large numbers of carefully structured prompts, records the outputs, and uses those input–output pairs to train a cheaper copy of the model. A distillation attack is theft of behaviour, carried out one legitimate-looking request at a time.
Paste JSONL — one JSON object per line — from your API gateway or provider logs. Recognised fields: timestamp, api_key_id, model, prompt_len, topic, completion_tokens and prompt_prefix (all optional except a key id; aliases like api_key, prompt_length and ts also work). The checker groups requests by key and scores five signals per key:
Request volume alone scores zero points. A busy, narrow, irregular key is a customer; a systematic key is a suspect.
Source: OpenCode incident reporting as covered October 17–20, 2026 (labeled here as the incident account; figures are as reported by the operator). Key facts from that reporting:
Ordinary API abuse is usually about volume for its own sake: credential stuffing, free-tier farming, resale of raw access, or a runaway script. Scraping is about content: pulling pages or data out. Distillation is different in intent and in shape. The goal is the model's behaviour itself — a training set that transfers capability to a rival model — so the traffic is designed for coverage: every topic, every style, every edge of the response surface, probed evenly and repeatedly. That is why distillation survives spend dashboards and rate totals that catch cruder abuse, and why per-key pattern analysis — topic breadth, paraphrase clustering, staircase sweeps, pacing regularity, cross-key prefixes — is the detection layer that actually sees it.
Look at behaviour per API key, not totals. Distillation leaves a pattern: one key sweeps systematically across many topics, sends clusters of near-identical prompt lengths (paraphrase probing), walks a parameter such as prompt length or requested tokens up in a steady staircase, fires at machine-regular intervals, and sometimes shares the same prompt prefix across several keys. Paste your gateway logs into the checker on this page: it scores exactly those signals per key and returns CLEAN, WATCH or DISTILLATION-SUSPECT with the fired signals named.
No. A busy legitimate customer is high-volume but narrow: a few topics, varied prompt shapes, human-irregular timing, one product workflow. A distillation run is high-volume and systematic: broad topic coverage, repeated near-identical probes, staircase parameter sweeps and regular pacing. Volume alone proves nothing — that is why this checker scores zero points for request count by itself, and why a key with modest volume can still be DISTILLATION-SUSPECT if its pattern is systematic.
Throttle the suspect key, not your whole API. First, cut that key's rate limit and concurrency to near zero while you review — extraction needs volume and speed, so pacing limits hurt it most. Second, alert on topic-sweep behaviour: a single key touching an unusual breadth of topics in a short window. Third, rotate the key and require re-verification of the account behind it. Do not start by raising prices or throttling everyone: that punishes legitimate customers and barely slows a determined extractor.
No. Spend dashboards show how much a key consumed, aggregated over time — they miss the pattern entirely. A distillation run can be spread across several keys and kept under spend alerts on each one, and a legitimate power user can outspend an extractor while doing nothing wrong. Detection needs per-request log structure: topics, prompt lengths, timing and prefixes per key. Billing tells you the size of the fire after the fact; log patterns are the smoke detector.
Related checks:
Get early access to the Ingenious AI platforms: DisclosureGuard · ModelMinder · TermsWatch · Vibe-Code Audit · Rogue-Agent Defense · BreachHunter · ChatBreaker · Agent Flight Recorder · Agent Auth Gateway · DomainGuard · ContentCraft AI
Get early access on WhatsApp →
Incident facts on this page are from the labeled source above: OpenCode's incident account as reported October 17–20, 2026. The checker is a heuristic pattern scorer running entirely in your browser — verdicts are risk indicators for triage, not proof of intent; review a flagged key's actual prompts and account history before acting against a customer. The preloaded log is synthetic sample data. The full open-source tool is the Ingenious AI distillation-attack-detector repo (queued for publication).