They do have Anthropic and OpenAi as vendors, who are at the center of this hack as well, and who have been beating the "distillation attack" drum on a regular basis.

OpenCode, and the lot, will need to release an open, public, dataset containing the original queries (and other relevant details) that the hacked keys were used for. I'm unwilling to trust those industry players at their word. We need to do our own community analyses.