As a philosopher^H person on twitter once said: "If you find two ants in your kitchen, the best estimate of the total number of ants in your kitchen is not two." OpenCode has some pedigree here.

Yeah, it's very confusing especially if you're not in the loop and their docs were only updated recently and was confusing during the v1 -> v2 transition weeks / months ago.

So far, "OpenCode" has gone through several possible definitions:

- OpenCode Terminal / CLI - This is what you get normally. Runs a service in the background and the CLI is your interface.

- OpenCode Desktop - Instead of a CLI, you get a desktop interface.

Most users usually stop here. You just install the app and you connect wherever.

So there's the services where they both make money and make things easier for users:

- OpenCode Console - Basically the serving platform for both Zen and Go, and has expanded to a hosted inference gateway and somewhat similar to OpenRouter or a managed LiteLLM. Has the option to BYOK if you have existing AI platform accounts so it charges those instead of Zen, and that's what got compromised.

- OpenCode Zen - the API service they host if you want to get access to providers but don't want to pay individually per API platform. Similar to OpenRouter. I noticed they're kinda slowly dropping the Zen moniker.

- OpenCode Go - the subscription service that they host that features open weight models and select low-cost models from frontier labs. Has different policies when it comes to privacy and retention compared to Zen.

- OpenCode Black - a limited-time, limited access subscription service that grants access to frontier models. Not sure if this is still alive or not.

I thought that the many provider pay as you go product from OpenCode was Zen. Also, how does OpenCoe Go fit into this?

NNN... trust is already broken

Oh they’re a YC company: https://www.ycombinator.com/companies/opencode

The title should say "OpenCode Console" not "OpenCode".

How did you determine that it has been "flagged by many"?

Pretty pathetic if true. Imagine if they spent as much effort securing their systems as they spend brigading and astroturfing after getting 0wned.

Then next time do a less clickbait-y title: OpenCode had a leak of API keys for their service that is similar to OpenRouter; this does not affect most users.

It actually is a thing, although indirectly in a hacky way! If you push keys from GitHub secret scanning partners to a public repo or a gist, they get sent to the partner who (usually) instantly revoke them. So if you want to help someone, just make a public gist with the key and delete it like 15 seconds later, it'll be enough.

https://docs.github.com/en/code-security/reference/secret-se... has a table with the active partners

That just turns a credential leak into a denial of service - one that can be triggered from anywhere.

If you use the hosted OpenCode Console and bring your own API keys, then they'd have your keys on their backend servers.

The announcement is needlessly confusing, but if you only use the CLI, you're not affected. There is no supply chain attack.

They need to explain this, by releasing a detailed RCA.

It sounds like most users are not affected (zen | go), and that if you are, you would have received an email. Check your OpenAi and Anthropic account for usage that was not yours.

Run a gateway like GoModel instead of uploading your keys to a vendor to prevent this class of attack in the future.

https://gomodel.enterpilot.io/ (my preferred gateway)

That's the only known impact so far. But we don't know the details of how these keys were exposed, so it's not entirely clear why or how "only keys" might have been affected

This appears to affect users of Opencode Console, which appears to be an Openrouter-type thing?

https://dev.opencode.ai/console/

It's actually kinda hard to figure out what it is. But it does appear to be different that the CLI

From https://opencode.ai/v2/docs#connect :

> If you’d like easy access to all the best coding models you can try out OpenCode Console.

Turns out even if you used credentials locally, you could've have been impacted as the .env files were also consumed by the agents. This is from some comments on Reddit / Google, so take it with a grain of salt.

It doesn't say the CLI was hacked does it?

It sounds like only a hosted service was compromised, not the open source OpenCode binary that users run on their own machines. So this wouldn't explain that.

It triggers me when these companies think that users are fool. I would have appreciated them, if they have disclosed things more transparently.

"mass distillation campaign" there's no public evidence of this. I wonder what OpenCode/Anomaly has, would be an interesting postmortem.

Obviously they don't want to share details because it's ongoing

We don't yet know what the hacked api keys were used for. We would need grand transparency, like an open dataset with the original queries, so that the public can validate through a collaborative effort. I'm not keen to accept their early conclusions, eventual RCA summary stats, or METR reports.

Yes

yup, in working through a major security regression in the CLI with them this week, our gut feeling is that they did too much eyes and thinking free coding, trusting the ai output that their new design, was good, twice. It took a couple of iterations to get it in a better place.

you can learn more from here, they did handle that one much better, all-in-all

https://news.ycombinator.com/item?id=50075319

Honestly, who isn't bragging about their vibecoding tokenmaxxing attitude nowadays?

I saw the email this morning from OpenCode about my key being compromised alongside an email from Anthropic stating that I used up my $20 in API credits for the month. I hope they built something cool with those tokens!

Yes

"but all my opencode keys were deactivated in tbe process"

Similarly woke up this morning to find my OpenCode Go API key had been revoked (remaining monthly usage allowance fortunately not touched).

Whether that was precautionary or is evidence of wider data leak, who knows?

Concur that OC's X messaging is mostly 'Marketing by Sounding off like a Dick' and they're certainly not known for having the best documentation either.

What the the purpose of this comment? Neither of those "red flags" you linked to are related (one is about config loading precedence, and the other is about Codex CLI, which is completely a completely different product and development team.

Exterior-compliance proxies, yes, are a good thing; but are also completely unrelated to the fact that OpenCode's hosted solution, that requires having credentials in some fashion, was popped.

Shitting on anyone who uses OpenCode (rather than your preferred vendor-specific product) as not being "sensible" is also completely out of hand and unnecessary.

A "distillation attack" is when someone tries to extract training data from a closed source model through the API of the Big Ai labs. Frontier model traces can be used to train other models with less effort. We don't use the word "attack" when a company does this with their own models or when we use open weights as the teacher model. This is often used to help train flash and smaller models from the mega models. The technique is used widely throughout industry.

We do not know if that is what the hacked API keys were used for. Could be distillation, could be API reselling. We will need more transparency into the nature of the requests made by the attacker. I would like to see an open dataset of the queries made with the compromised keys. All of them as originally made, not aggregate stats or another METR report.

The keys could have also been used to resell API access on the black market, again, we need good transparency to know. Considering the upstream parties involved, getting the distillation narrative out there early, without evidence, does fit a larger pattern we have seen from them this year.

No I think they used the stolen API keys to perform distillation.

Who else has a plan like OpenCode Go for subsidized access to cheap models? I've been using Qwen 3.7 Plus on it and having great results for $10 per month with my personal usage. I'm not aware of any other options with nearly that value, but I am interested in switching because OpenCode isn't so trustworthy, it seems. This is the second issue that I've seen.

The other issue: https://news.ycombinator.com/item?id=49655991

Can you elaborate on that?

They might have spent next to 0 time actually 'hacking' - they may have just told Opencode to hack Opencode website and let it run for hours or days till it succeeded.

API keys have been routinely stolen in mass automated attacks for malicious usage long before LLMs even existed

Similar to other stolen goods, it's not hard to resell tokens on the black market: https://vectoral.com/blog/token-relay-market

The tokens of frontier are valuable...

Yes, they think we are foooool

Yes, I am interested in how a distillation attack can leak credentials...

I want an open dataset of the attackers queries with sufficient details that we can do our own analyses, Big Ai has lost most of the public's trust, we the public need to be able to verify for ourselves

For the inference APIs, which need to bill users. It's unclear why OpenCode's servers (presumably) had access to the API credentials.

opencode go and zen?

All the comments I've seen about warning signs point to opencode the cli, where this is about one of opencode's hosted services.

I think it may just be bad automated flagging. I vouch'd them since they don't really seem to violate any rules/guidelines (right?)

Because they're unrelated to this incident.

FWIW, OpenRouter has the exact same feature.

OpenCode now has a trust page like any vendor worth consideration, but this is generally something enterprises look for. They are working towards a more mature enterprise offering, but this does not bode well for the trust going forward. We're going to need a really, really good RCA and process remediation statement. What lead to this happening, not the hack mechanics, but what at the company has allowed a number of bad security decisions to show up lately, and what are they going to do differently going forward. Hopefully more human in the loop and an external security audit by a trusted name in the security industry.

https://trust.opencode.ai/

We were planning to fix our vibecoded mess.

it’s funny how no one ever announces their critical vulns with “we have been hacked, you should uninstall our software and use something else”, at some point in the severity of the vuln that should be the conclusion, but no one ever says it

"when challenged about sending data to openrouter without listing it as a 3rd party processor they offered a dismissive response. the same with running prompts through cloudflare. seems trivial, but signifies general disinterest in security."

I did have an account but moved off for security reasons.

Damn, that sucks. I didn't know OpenCode was this bad when it came to privacy.

This is one of the reasons I don't trust opencode. It looked very nice on paper when it first came out and there were no alternatives. However, today I'd probably stick with simple pi setup (not sure how much better than opencode, but it looks like they don't have all this cloud stuff) or just use one of the big tech agents and call it a day.

If i dont use any of their models nor i am signed in, is that a problem? i dont see anything in wireshark except for models.opencode.ai

I love the smell of misinformation in the morning. All it ever did was give people free model for title gen, if they didn't set one themselves. Feature you could disable or set on your own model. That was since removed, so now there is no free fallback model.

That is it. It is still private by default