it’s funny how no one ever announces their critical vulns with “we have been hacked, you should uninstall our software and use something else”, at some point in the severity of the vuln that should be the conclusion, but no one ever says it
This is one of the reasons I don't trust opencode. It looked very nice on paper when it first came out and there were no alternatives. However, today I'd probably stick with simple pi setup (not sure how much better than opencode, but it looks like they don't have all this cloud stuff) or just use one of the big tech agents and call it a day.
"when challenged about sending data to openrouter without listing it as a 3rd party processor they offered a dismissive response. the same with running prompts through cloudflare. seems trivial, but signifies general disinterest in security."
I did have an account but moved off for security reasons.
I love the smell of misinformation in the morning.
All it ever did was give people free model for title gen, if they didn't set one themselves. Feature you could disable or set on your own model.
That was since removed, so now there is no free fallback model.
It sent the prompt to a GPT-5-nano model with the max zdr you can get on openai.
That was done to give people free title gen, unless they set it themselves.
Title gen does not send anything but the prompt.
Maybe try a sensible approach first, cause so far this is assumed, for no reason, to be done maliciously. "to steal data" and the like.
Opencode's source code is public, so you can verify any claim against it directly.
they do have Anthropic and OpenAi as vendors, who are at the center of this hack as well, and who have been beating the "distillation attack" drum on a regular basis
OpenCode, and the lot, will need to release an open, public, dataset containing the original queries (and other relevant details) that the hacked keys were used for. I'm unwilling to trust those industry players at their word. We need to do our own community analyses.
If OpenCode is not releasing all of the details about the exposure at the moment, it likely would be a good idea to rotation keys for the connected services at this point
We don't yet know what the hacked api keys were used for. We would need grand transparency, like an open dataset with the original queries, so that the public can validate through a collaborative effort. I'm not keen to accept their early conclusions, eventual RCA summary stats, or METR reports.
It does not sound like those were the systems affected by this, there is another service that lets you upload keys for Ant/OAI, where you add one key for your company and then OpenCode enables you to budget / route across vendors.
Use a gateway like LiteLLM or GoModel, don't upload keys to a vendor, they are doing too much eyes and brain free coding this year
Why are the comments pointing out there were warning signs early on being downvoted/flagged?
I looked at the linked comments, and they seem valid. I mean I dont want to go full tinfoil hat here, but what's the deal? Some people just really like opencode or something?
There's a pattern though, they companies at the front of the Ai hype train love to brag about their eyes and brain free coding practices. Reap what you sow I suppose
As the person who worked with the OpenCode team on the CLI security regression this last week, I do not think they are unrelated, though there is no direct connection.
My read is too much vibemaxxing, not enough critical analyses of the Ai output and (re)designs of various systems in their code base.
I don't use OpenCode but I would like to know who this impacts. Surely people who are just using OpenCode locally with their own credentials wouldn't be impacted, right? This sounds like something where you have a hosted service and you put your keys into that. Not saying this isn't bad, but it isn't clear and they're not sharing any information.
Turns out even if you used credentials locally, you could've have been impacted. This is from some comments on Reddit / Google, so take it with a grain of salt.
I am the author of this post. Looks like OpenCode fans / team is not happy with this post coming on the first page of HN. It has already been flagged by many.
I never ask for upvotes, but would be great if you can upvote it.
Thanks!
They presumably meant that it’s been downranked relative to what you’d expect from a post with that many upvotes in that short of a time frame. Hundreds of upvotes in a few hours is usually a top 5 post
Then next time do a less clickbait-y title: OpenCode had a leak of API keys for their service that is similar to OpenRouter; this does not affect most users.
It's a little more than that. It seems that keys for OpenAI / Anthropic APIs that were STORED on OpenCode's OpenRouter-like backend got leaked – which additionally means that OpenCode has no ability to refund people for their losses.
... no, I don't think so? Taking payment for <X> (providing a proxy/platform for hosting/proxying to agents) doesn't mean that you're inherently liable for <Y>, if <Y> is 'bring your own key from a third-party provider'.
dang (one of the YC moderators) has claimed in the past that they moderate less when a story involves a YC company. Of course I have no way to confirm either way, and it’s possible there still is foul play from outside their control, but in general I am inclined to believe it. This story is now at almost 1000 points.
I saw the email this morning from OpenCode about my key being compromised alongside an email from Anthropic stating that I used up my $20 in API credits for the month. I hope they built something cool with those tokens!
Probably another tool help steal more tokens. Or to probe more controversial topics without fear of getting banned. Would you be able to check in the history of what they made?
I'd like to know also - don't fully understand api, tokens stuff. Can user get log of what the (stolen or not) tokens were used for? Or that just kept by the provider in secret
In this specific incident, users should be able to see the history of queries for their own keys, in both OpenCode Console and their Ant/Oai accounts. All three companies have this audit feature in their respective consoles.
I would like to see the companies release an open dataset of the attackers queries, such that we can do our own analyses as a community. Public trust is in the xitter with these folks.
It sounds like only a hosted service was compromised, not the open source OpenCode binary that users run on their own machines. So this wouldn't explain that.
They have multiple online platforms, reading other comments, this looms to be the BYOK system where you upload keys to other vendors, as compared to Go, where you can generate API keys for your $10 sub
I think every API key system should have endpoint "invalidate_api_key" this way whitehat hackers or the party who stored them could invalidate all keys in the case they leak. Now it is race against the time, and everybody got email, and everyone must act themselves.
Not any more than any other public endpoint service exposes.
This revocation endpoint can be protected by auth too. Use API key that you're revoking in auth.
That's the only known impact so far. But we don't know the details of how these keys were exposed, so it's not entirely clear why or how "only keys" might have been affected
They might have spent next to 0 time actually 'hacking' - they may have just told Opencode to hack Opencode website and let it run for hours or days till it succeeded.
if the keys were used for a black market resell, the model is less important and all tokens would have been valuable, but certainly more expensive tokens earn the hacker more money over the same time frame
Why are my API keys in the workspace exposed? Does OpenCode send my API keys to their backend servers??? Was this a supply chain attack that infected the opencode program itself? What is going on?
Do you work for OpenCode? How do you know this? Every similarly sized start up would have added the statement “OpenCode Desktop users are not affected.” The fact they didn’t means they can not definitively rule that case out. It would be prudent to rotate out your third party keys in this situation, especially if it is a API key with a high drain limit.
It sounds like most users are not affected (zen | go), and that if you are, you would have received an email. Check your OpenAi and Anthropic account for usage that was not yours.
I want an open dataset of the attackers queries with sufficient details that we can do our own analyses, Big Ai has lost most of the public's trust, we the public need to be able to verify for ourselves
Wait, is the openchode hack the cause of all the people complaining about their OAI usage getting drained/vanishing at alarming rates? That's pretty funny ngl.
The way some of this place's employees post and act online, can't say I feel all that bad.
yup, in working through a major security regression in the CLI with them this week, our gut feeling is that they did too much eyes and thinking free coding, trusting the ai output that their new design, was good, twice. It took a couple of iterations to get it in a better place.
we don't know what the stolen keys were used for, that will require real transparency on OpenCode's part, like an open dataset of the original queries, so we can do our own analyses into the nature
I would recommend running your own gateway instead of uploading keys to a vendor. My gateway of choice is GoModel
what’s interesting is that all those efforts that go into sandboxing through virtualization wouldn’t have helped here. But the solutions that proxy the api keys and hide them from agents might have worked as a defense in depth.
of course any sensible engineer that uninstalled this 6 months ago and used codex and claude code directly also avoided this, gg
What the the purpose of this comment? Neither of those "red flags" you linked to are related (one is about config loading precedence, and the other is about Codex CLI, which is completely a completely different product and development team.
Exterior-compliance proxies, yes, are a good thing; but are also completely unrelated to the fact that OpenCode's hosted solution, that requires having credentials in some fashion, was popped.
Shitting on anyone who uses OpenCode (rather than your preferred vendor-specific product) as not being "sensible" is also completely out of hand and unnecessary.
I submitted one of those originally and do think that incident is relevant. Not related, but it does qualify as a red flag generally for the company and their attention to their system designs with respect to security.
Our read on the situation is too much eyes and brain free coding, that they assumed the ai redesign of the configuration system was sound. It took a couple of PRs and explanations for them to bring the system to a better place, such that MDM config was respected at the highest priority.
I do give the OpenCode team a lot of credit, at least Aiden, for the handling of this case.
you login to their website, and you are presented with a list of providers where you can click and add your provider api key.
how the key is stored on the backend isn't clear, but it is akin to handing your password or if you know crypto, your private key, to someone and letting them store it for you.
from what i can tell, there are no links within the console to a ToS, Privacy policy or anything else. there are no warnings or documentation about how they store your keys.
someone else in this thread linked to this issue, but this comment is especially insane given that i can't find any privacy policy or tos for the console.
OpenCode now has a trust page like any vendor worth consideration, but this is generally something enterprises look for. They are working towards a more mature enterprise offering, but this does not bode well for the trust going forward. We're going to need a really, really good RCA and process remediation statement. What lead to this happening, not the hack mechanics, but what at the company has allowed a number of bad security decisions to show up lately, and what are they going to do differently going forward. Hopefully more human in the loop and an external security audit by a trusted name in the security industry.
I do not go on X any more (or any big social for that matter)
I've heard Dax has a number of "social media stunt" kinds of posts and others showing them being rather unprofessional (eg. something that appears to be excessive drinking at a company event)
150 comments
[ 4.2 ms ] story [ 11.9 ms ] threadThis was a leak of keys added in a web UI
https://github.com/earendil-works/pi/issues/10895
I did have an account but moved off for security reasons.
That is it. It is still private by default
All it "ever did" was send your entire prompt/context to a "free" model for harvesting. The astroturfing in this thread is absurd.
Maybe try a sensible approach first, cause so far this is assumed, for no reason, to be done maliciously. "to steal data" and the like.
Opencode's source code is public, so you can verify any claim against it directly.
OpenCode, and the lot, will need to release an open, public, dataset containing the original queries (and other relevant details) that the hacked keys were used for. I'm unwilling to trust those industry players at their word. We need to do our own community analyses.
Use a gateway like LiteLLM or GoModel, don't upload keys to a vendor, they are doing too much eyes and brain free coding this year
- https://gomodel.enterpilot.io/ (my preference)
- https://docs.litellm.ai/docs/
I looked at the linked comments, and they seem valid. I mean I dont want to go full tinfoil hat here, but what's the deal? Some people just really like opencode or something?
My read is too much vibemaxxing, not enough critical analyses of the Ai output and (re)designs of various systems in their code base.
https://dev.opencode.ai/console/
It's actually kinda hard to figure out what it is. But it does appear to be different that the CLI
From https://opencode.ai/v2/docs#connect :
> If you’d like easy access to all the best coding models you can try out OpenCode Console.
https://vale.rocks/micros/20260512-0652
If they took payment, they are liable and they must have the ability to refund.
I would like to see the companies release an open dataset of the attackers queries, such that we can do our own analyses as a community. Public trust is in the xitter with these folks.
that's why virustotal was flagging it then
In essence they used OpenCode Zen similar to OpenRouter, where you can BYOK or use theirs and be charged token rates.
It's in their announcement; it's just not written in a way that people immediately understand.
The way some of this place's employees post and act online, can't say I feel all that bad.
> related to a large scale distillation attack
I'm not sure how this adds up. I could understand if this impacted their uptime, but not security.
Are they actually saying a bunch of credentials were stolen and are being used for distillation?
you can learn more from here
https://news.ycombinator.com/item?id=50075319
I would recommend running your own gateway instead of uploading keys to a vendor. My gateway of choice is GoModel
https://gomodel.enterpilot.io/
https://news.ycombinator.com/item?id=50075319
https://news.ycombinator.com/item?id=50060694
what’s interesting is that all those efforts that go into sandboxing through virtualization wouldn’t have helped here. But the solutions that proxy the api keys and hide them from agents might have worked as a defense in depth.
of course any sensible engineer that uninstalled this 6 months ago and used codex and claude code directly also avoided this, gg
Exterior-compliance proxies, yes, are a good thing; but are also completely unrelated to the fact that OpenCode's hosted solution, that requires having credentials in some fashion, was popped.
Shitting on anyone who uses OpenCode (rather than your preferred vendor-specific product) as not being "sensible" is also completely out of hand and unnecessary.
Our read on the situation is too much eyes and brain free coding, that they assumed the ai redesign of the configuration system was sound. It took a couple of PRs and explanations for them to bring the system to a better place, such that MDM config was respected at the highest priority.
I do give the OpenCode team a lot of credit, at least Aiden, for the handling of this case.
https://github.com/anomalyco/opencode/pull/51337#issuecommen...
I'm now trying to get the Pi harness to support MDM, but it is not going well...
https://github.com/earendil-works/pi/issues/10895
you login to their website, and you are presented with a list of providers where you can click and add your provider api key.
how the key is stored on the backend isn't clear, but it is akin to handing your password or if you know crypto, your private key, to someone and letting them store it for you.
from what i can tell, there are no links within the console to a ToS, Privacy policy or anything else. there are no warnings or documentation about how they store your keys.
someone else in this thread linked to this issue, but this comment is especially insane given that i can't find any privacy policy or tos for the console.
https://github.com/anomalyco/opencode/issues/10416#issuecomm...
https://trust.opencode.ai/
https://x.com/thdxr/status/2111831348336091179
https://x.com/thdxr/status/2111790511409258796
I've heard Dax has a number of "social media stunt" kinds of posts and others showing them being rather unprofessional (eg. something that appears to be excessive drinking at a company event)
The opencode CLI has no impact.