Hacker News

Oh they’re a YC company: https://www.ycombinator.com/companies/opencode

The title should say "OpenCode Console" not "OpenCode".

How did you determine that it has been "flagged by many"?

Then next time do a less clickbait-y title: OpenCode had a leak of API keys for their service that is similar to OpenRouter; this does not affect most users.

It actually is a thing, although indirectly in a hacky way! If you push keys from GitHub secret scanning partners to a public repo or a gist, they get sent to the partner who (usually) instantly revoke them. So if you want to help someone, just make a public gist with the key and delete it like 15 seconds later, it'll be enough.

https://docs.github.com/en/code-security/reference/secret-se... has a table with the active partners

That just turns a credential leak into a denial of service - one that can be triggered from anywhere.

If you use the hosted OpenCode Console and bring your own API keys, then they'd have your keys on their backend servers.

The announcement is needlessly confusing, but if you only use the CLI, you're not affected. There is no supply chain attack.

They need to explain this, by releasing a detailed RCA.

That's the only known impact so far. But we don't know the details of how these keys were exposed, so it's not entirely clear why or how "only keys" might have been affected

This appears to affect users of Opencode Console, which appears to be an Openrouter-type thing?

https://dev.opencode.ai/console/

It's actually kinda hard to figure out what it is. But it does appear to be different that the CLI

From https://opencode.ai/v2/docs#connect :

> If you’d like easy access to all the best coding models you can try out OpenCode Console.

Turns out even if you used credentials locally, you could've have been impacted as the .env files were also consumed by the agents. This is from some comments on Reddit / Google, so take it with a grain of salt.

It sounds like only a hosted service was compromised, not the open source OpenCode binary that users run on their own machines. So this wouldn't explain that.

It triggers me when these companies think that users are fool. I would have appreciated them, if they have disclosed things more transparently.

"mass distillation campaign" there's no public evidence of this. I wonder what OpenCode/Anomaly has, would be an interesting postmortem.

Obviously they don't want to share details because it's ongoing

Yes

[dead]

It doesn't say the CLI was hacked does it?

I saw the email this morning from OpenCode about my key being compromised alongside an email from Anthropic stating that I used up my $20 in API credits for the month. I hope they built something cool with those tokens!

Yes

Can you elaborate on that?

Honestly, who isn't bragging about their vibecoding tokenmaxxing attitude nowadays?

API keys have been routinely stolen in mass automated attacks for malicious usage long before LLMs even existed

They might have spent next to 0 time actually 'hacking' - they may have just told Opencode to hack Opencode website and let it run for hours or days till it succeeded.

The tokens of frontier are valuable...

Yes, they think we are foooool

FWIW, OpenRouter has the exact same feature.

For the inference APIs, which need to bill users. It's unclear why OpenCode's servers (presumably) had access to the API credentials.

opencode go and zen?

Yes, I am interested in how a distillation attack can leak credentials...

All the comments I've seen about warning signs point to opencode the cli, where this is about one of opencode's hosted services.

Because they're unrelated to this incident.

I think it may just be bad automated flagging. I vouch'd them since they don't really seem to violate any rules/guidelines (right?)

What the the purpose of this comment? Neither of those "red flags" you linked to are related (one is about config loading precedence, and the other is about Codex CLI, which is completely a completely different product and development team.

Exterior-compliance proxies, yes, are a good thing; but are also completely unrelated to the fact that OpenCode's hosted solution, that requires having credentials in some fashion, was popped.

Shitting on anyone who uses OpenCode (rather than your preferred vendor-specific product) as not being "sensible" is also completely out of hand and unnecessary.

We were planning to fix our vibecoded mess.

it’s funny how no one ever announces their critical vulns with “we have been hacked, you should uninstall our software and use something else”, at some point in the severity of the vuln that should be the conclusion, but no one ever says it

"when challenged about sending data to openrouter without listing it as a 3rd party processor they offered a dismissive response. the same with running prompts through cloudflare. seems trivial, but signifies general disinterest in security."

I did have an account but moved off for security reasons.

If i dont use any of their models nor i am signed in, is that a problem? i dont see anything in wireshark except for models.opencode.ai

This is one of the reasons I don't trust opencode. It looked very nice on paper when it first came out and there were no alternatives. However, today I'd probably stick with simple pi setup (not sure how much better than opencode, but it looks like they don't have all this cloud stuff) or just use one of the big tech agents and call it a day.

Damn, that sucks. I didn't know OpenCode was this bad when it came to privacy.

[dead]

[dead]