OpenCode Hacked: User credentials leaked
twitter.comTo clarify something that the OpenCode team has done a bad job of clarifying:
The leak was for something called 'OpenCode Console', which is distinct and separate from the OpenCode coding agent. If you're just using the coding agent, you're not affected. 'OpenCode Console' is a service that is similar to OpenRouter, but is much less widely used.
The name 'OpenCode Console' is super confusing, because one might think it means the CLI coding agent. It does not. 'OpenCode Console' has nothing to do with the CLI/TUI coding agent, nor the desktop app version.
The situation is made worse by the fact that 'OpenCode Console' barely has any documentation online, and the official leak announcement does not make the distinction clear at all. The OpenCode team did a terrible job of communicating this, and that's on them.
Today is a bad day for people using 'OpenCode Console'. But most people, probably the vast majority of OpenCode users who are reading this, are not using 'OpenCode Console'.
Yeah, it's very confusing especially if you're not in the loop and their docs were only updated recently and was confusing during the v1 -> v2 transition weeks / months ago.
So far, "OpenCode" has gone through several possible definitions:
- OpenCode Terminal / CLI - This is what you get normally. Runs a service in the background and the CLI is your interface.
- OpenCode Desktop - Instead of a CLI, you get a desktop interface.
Most users usually stop here. You just install the app and you connect wherever.
So there's the services where they both make money and make things easier for users:
- OpenCode Console - Basically the serving platform for both Zen and Go, and has expanded to a hosted inference gateway and somewhat similar to OpenRouter or a managed LiteLLM. Has the option to BYOK if you have existing AI platform accounts so it charges those instead of Zen, and that's what got compromised.
- OpenCode Zen - the API service they host if you want to get access to providers but don't want to pay individually per API platform. Similar to OpenRouter. I noticed they're kinda slowly dropping the Zen moniker.
- OpenCode Go - the subscription service that they host that features open weight models and select low-cost models from frontier labs. Has different policies when it comes to privacy and retention compared to Zen.
- OpenCode Black - a limited-time, limited access subscription service that grants access to frontier models. Not sure if this is still alive or not.
I thought that the many provider pay as you go product from OpenCode was Zen. Also, how does OpenCoe Go fit into this?
No, Console is different from Zen (and from Go). But you are reasonable in asking about it. The opencode team has done a horrible job of communicating what's actually going on. They have suffered real brand damage from this, and they deserve it.
NNN... trust is already broken
I am the author of this post. Looks like OpenCode fans / team is not happy with this post coming on the first page of HN. It has already been flagged by many. I never ask for upvotes, but would be great if you can upvote it. Thanks!
Oh they’re a YC company: https://www.ycombinator.com/companies/opencode
The title should say "OpenCode Console" not "OpenCode".
Yeah that’s a big difference
How did you determine that it has been "flagged by many"?
Interesting, #1 raw rank yet never made it past ~#10 - haven’t seen that specifically: https://news.social-protocols.org/stats?id=50133401
Thanks for the detailed metrics. This proves my point...
The post was visible when I am logged in. But when I opened the /newest page on incognito the post wasn't there.
It’s #14 on homepage when not logged in, same as when logged in.
Now it is
It's clearly heavily down voted, just look at when it was added, how many points it has and its relative position.
You cant downvote HN posts (comments you can)
They presumably meant that it’s been downranked relative to what you’d expect from a post with that many upvotes in that short of a time frame. Hundreds of upvotes in a few hours is usually a top 5 post
Afaik flagging acts like a super-downvote as far as the algorithm is concerned
Yes flagging is super downvote
Pretty pathetic if true. Imagine if they spent as much effort securing their systems as they spend brigading and astroturfing after getting 0wned.
Then next time do a less clickbait-y title: OpenCode had a leak of API keys for their service that is similar to OpenRouter; this does not affect most users.
It's a little more than that. It seems that keys for OpenAI / Anthropic APIs that were STORED on OpenCode's OpenRouter-like backend got leaked – which additionally means that OpenCode has no ability to refund people for their losses.
> which additionally means that OpenCode has no ability to refund people for their losses.
If they took payment, they are liable and they must have the ability to refund.
I guess Anthropic and OpenAI might refund based on good will.
... no, I don't think so? Taking payment for <X> (providing a proxy/platform for hosting/proxying to agents) doesn't mean that you're inherently liable for <Y>, if <Y> is 'bring your own key from a third-party provider'.
Agree, they won't refund. But they might if the total damage is < $100K
I think every API key system should have endpoint "invalidate_api_key" this way whitehat hackers or the party who stored them could invalidate all keys in the case they leak. Now it is race against the time, and everybody got email, and everyone must act themselves.
It actually is a thing, although indirectly in a hacky way! If you push keys from GitHub secret scanning partners to a public repo or a gist, they get sent to the partner who (usually) instantly revoke them. So if you want to help someone, just make a public gist with the key and delete it like 15 seconds later, it'll be enough.
https://docs.github.com/en/code-security/reference/secret-se... has a table with the active partners
Only responsible thing in this case would have been for OpenCode people to invalidate all keys. But I guess it is not that straightforward if Anthropic/OpenAI etc don't have endpoint for it.
There's no self-serve endpoint, but OpenCode could send the inference providers the leaked keys and ask for them to be revoked, which is a thing the inference providers can do. It's possible that this'll happen, apparently remediation is still in progress.
That just turns a credential leak into a denial of service - one that can be triggered from anywhere.
In this case you'd probably prefer your key to be disabled rather than spending $$$ on tokens for everyone else
Think that through - the person who stole the key has the decision to use it or revoke it through this hypothetical system.
If they are acting maliciously, they will take the choice that most hurts you and/or benefits them.
If the key is useless to them and revoking it hurts you, then they would do that.
If the key wasn’t useless to them, then… they would just use it and not revoke it?
It for whitehat third parties who discover unprotected keys obviously people intentionally stealing keys will not revoke them generally.
And the whitehack hackers finding keys should do what, exactly?
Unilaterally decide they should be revoked, without contacting the owner?
And that’s not malicious?
Not any more than any other public endpoint service exposes. This revocation endpoint can be protected by auth too. Use API key that you're revoking in auth.
How does that make any sense?
I see now from another comment you thought about denial of service for service that leaked key. And I thought about mass leak resulting in DDOS onto API provider. Wrong guess from me.
Yes. Is this a bad thing?
Of course it is? A key for some weather API getting leaked isn’t the end of the world, but having it revoked and breaking your weather app is.
Why are my API keys in the workspace exposed? Does OpenCode send my API keys to their backend servers??? Was this a supply chain attack that infected the opencode program itself? What is going on?
If you use the hosted OpenCode Console and bring your own API keys, then they'd have your keys on their backend servers.
The announcement is needlessly confusing, but if you only use the CLI, you're not affected. There is no supply chain attack.
They need to explain this, by releasing a detailed RCA.
Is my understanding correct that this only affected some OpenCode Zen users who stored their (BYOK) API keys from Anthropic/Google/OpenAI?
In essence they used OpenCode Zen similar to OpenRouter, where you can BYOK or use theirs and be charged token rates.
That's the only known impact so far. But we don't know the details of how these keys were exposed, so it's not entirely clear why or how "only keys" might have been affected
@dang this title needs updating: "OpenCode Console hacked: User credentials leaked"
The opencode CLI has no impact.
It doesn't say the CLI was hacked does it?
OpenCode = OpenCode CLI to most people (as seen in the dozens of comments making that assumption in this thread)
OpenCode is the name of the company though.
The company name is Anomaly, seems they had a namesake
I don't use OpenCode but I would like to know who this impacts. Surely people who are just using OpenCode locally with their own credentials wouldn't be impacted, right? This sounds like something where you have a hosted service and you put your keys into that. Not saying this isn't bad, but it isn't clear and they're not sharing any information.
This appears to affect users of Opencode Console, which appears to be an Openrouter-type thing?
https://dev.opencode.ai/console/
It's actually kinda hard to figure out what it is. But it does appear to be different that the CLI
From https://opencode.ai/v2/docs#connect :
> If you’d like easy access to all the best coding models you can try out OpenCode Console.
Turns out even if you used credentials locally, you could've have been impacted as the .env files were also consumed by the agents. This is from some comments on Reddit / Google, so take it with a grain of salt.
Can someplease explain what is a distillation attack?
Wait, is the openchode hack the cause of all the people complaining about their OAI usage getting drained/vanishing at alarming rates? That's pretty funny ngl.
The way some of this place's employees post and act online, can't say I feel all that bad.
https://news.ycombinator.com/item?id=50108261
that's why virustotal was flagging it then
It sounds like only a hosted service was compromised, not the open source OpenCode binary that users run on their own machines. So this wouldn't explain that.
They have multiple online platforms, reading other comments, this looms to be the BYOK system where you upload keys to other vendors, as compared to Go, where you can generate API keys for your $10 sub
I’m a bit confused by the wording here, does it mean the credentials were hacked and then used to perform a mass distillation campaign?
It triggers me when these companies think that users are fool. I would have appreciated them, if they have disclosed things more transparently.
"mass distillation campaign" there's no public evidence of this. I wonder what OpenCode/Anomaly has, would be an interesting postmortem.
Obviously they don't want to share details because it's ongoing
If OpenCode is not releasing all of the details about the exposure at the moment, it likely would be a good idea to rotation keys for the connected services at this point
Yes
So are people going to wake up and see their Anthropic, openAI, etc accounts drained?
I saw the email this morning from OpenCode about my key being compromised alongside an email from Anthropic stating that I used up my $20 in API credits for the month. I hope they built something cool with those tokens!
Probably another tool help steal more tokens. Or to probe more controversial topics without fear of getting banned. Would you be able to check in the history of what they made?
I'd like to know also - don't fully understand api, tokens stuff. Can user get log of what the (stolen or not) tokens were used for? Or that just kept by the provider in secret
Yes
Was it opencode who bragged about their vibecoding tokenmaxxing attitude or I'm mixing them with someone else?
yup, in working through a major security regression in the CLI with them this week, our gut feeling is that they did too much eyes and thinking free coding, trusting the ai output that their new design, was good, twice. It took a couple of iterations to get it in a better place.
you can learn more from here
Honestly, who isn't bragging about their vibecoding tokenmaxxing attitude nowadays?
OpenCreds
It’s just gonna make AI better it’s going to understand and learn.
They had it coming for too long. Playing the "open and free" card while keeping your API token on server (among so much else)
Awaiting for detailed breakdown of the incident. I am more interested in knowing , how can a distillation attack leak / expose credentials.
No I think they used the stolen API keys to perform distillation.
It’s fascinating that tokens are so valuable that people are spending so much time and effort hacking to obtain API keys.
They might have spent next to 0 time actually 'hacking' - they may have just told Opencode to hack Opencode website and let it run for hours or days till it succeeded.
Similar to other stolen goods, it's not hard to resell tokens on the black market: https://vectoral.com/blog/token-relay-market
API keys have been routinely stolen in mass automated attacks for malicious usage long before LLMs even existed
The tokens of frontier are valuable...
My understanding of the lingo, in layman's terms:
Hackers breached an Open Code legacy system containing customer keys for openai etc, and ran up large bills against the customer's openai accounts . The tokens were used to train the hacker's ai models (the distillation).
My guess is a more primitive arbitrage / resale attack . Like reselling EBT cards or "free" vpn traffic.
4 days ago red flags were raised
https://news.ycombinator.com/item?id=50075319
https://news.ycombinator.com/item?id=50060694
what’s interesting is that all those efforts that go into sandboxing through virtualization wouldn’t have helped here. But the solutions that proxy the api keys and hide them from agents might have worked as a defense in depth.
of course any sensible engineer that uninstalled this 6 months ago and used codex and claude code directly also avoided this, gg
What the the purpose of this comment? Neither of those "red flags" you linked to are related (one is about config loading precedence, and the other is about Codex CLI, which is completely a completely different product and development team.
Exterior-compliance proxies, yes, are a good thing; but are also completely unrelated to the fact that OpenCode's hosted solution, that requires having credentials in some fashion, was popped.
Shitting on anyone who uses OpenCode (rather than your preferred vendor-specific product) as not being "sensible" is also completely out of hand and unnecessary.
I submitted one of those originally and do think that incident is relevant. Not related, but it does qualify as a red flag generally for the company and their attention to their system designs with respect to security.
Our read on the situation is too much eyes and brain free coding, that they assumed the ai redesign of the configuration system was sound. It took a couple of PRs and explanations for them to bring the system to a better place, such that MDM config was respected at the highest priority.
I do give the OpenCode team a lot of credit, at least Aiden, for the handling of this case.
https://github.com/anomalyco/opencode/pull/51337#issuecommen...
I'm now trying to get the Pi harness to support MDM, but it is not going well... see this and please consider sharing your perspectives or support there
> security breach
> related to a large scale distillation attack
I'm not sure how this adds up. I could understand if this impacted their uptime, but not security.
Are they actually saying a bunch of credentials were stolen and are being used for distillation?
Yes, they think we are foooool
Looking forward to the post-mortem of this incident.
Yes, I am interested in how a distillation attack can leak credentials...
They have shown so so so many times that their culture is not aligned with trustworthy software. Yet people keep using it.
It's not like there wouldn't be any other harnesses either. Just switch to literally anything else please.
Who else has a plan like OpenCode Go for subsidized access to cheap models? I've been using Qwen 3.7 Plus on it and having great results for $10 per month with my personal usage. I'm not aware of any other options with nearly that value, but I am interested in switching because OpenCode isn't so trustworthy, it seems. This is the second issue that I've seen.
The other issue: https://news.ycombinator.com/item?id=49655991
Can you elaborate on that?
wtf was I getting many use OpenCode on OpenCode cloud emails last few days. Were they set up so that hackers can get more info?
But isn’t OpenCode open source why does it need credentials.
For the inference APIs, which need to bill users. It's unclear why OpenCode's servers (presumably) had access to the API credentials.
They function similar to openrouter BYOK.
Because people cut and pasted them in.
Maybe they support cloud agents.
opencode go and zen?
Why are the comments pointing out there were warning signs early on being downvoted/flagged?
I looked at the linked comments, and they seem valid. I mean I dont want to go full tinfoil hat here, but what's the deal? Some people just really like opencode or something?
All the comments I've seen about warning signs point to opencode the cli, where this is about one of opencode's hosted services.
I think it may just be bad automated flagging. I vouch'd them since they don't really seem to violate any rules/guidelines (right?)
Indeed. I've seen it happen before and it appears that they have automatic downvoting based on some criteria, possibly just some classifier. I've attributed it to some bot attack before, but it's a bit too common now.
Why does it being common downplay the bot attack to you? As time goes on, I'd assume bots activity to increase. I do not see it ever going away.
bots get caught and downvoting requires reputation.
Because they're unrelated to this incident.
the ux is kind of crazy.
you login to their website, and you are presented with a list of providers where you can click and add your provider api key.
how the key is stored on the backend isn't clear, but it is akin to handing your password or if you know crypto, your private key, to someone and letting them store it for you.
from what i can tell, there are no links within the console to a ToS, Privacy policy or anything else. there are no warnings or documentation about how they store your keys.
someone else in this thread linked to this issue, but this comment is especially insane given that i can't find any privacy policy or tos for the console.
https://github.com/anomalyco/opencode/issues/10416#issuecomm...
FWIW, OpenRouter has the exact same feature.
and their TOS/Privacy policies are equally light on details.
From OpenCode Team
---
Hi, We identified unauthorized access to a legacy system that we were in the process of decommissioning. Third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed. Please revoke and replace those keys through the relevant provider’s dashboard, update any applications using them, and review recent usage for unexpected activity.
We’re sorry this happened and will follow up with any updates.
We were planning to fix our vibecoded mess.
it’s funny how no one ever announces their critical vulns with “we have been hacked, you should uninstall our software and use something else”, at some point in the severity of the vuln that should be the conclusion, but no one ever says it
> uninstall our software
This was a leak of keys added in a web UI
I told you so: https://news.ycombinator.com/item?id=49243119
Me, 68 days ago:
> Beware of the author of tweet, who happens to be author of OpenCode - OpenCode will leak all your data to themselves and to shady 3rd parties. Author feigned ignorance and never fixed the issue. OpenCode among other harnesses is the shadiest of all.
"when challenged about sending data to openrouter without listing it as a 3rd party processor they offered a dismissive response. the same with running prompts through cloudflare. seems trivial, but signifies general disinterest in security."
I did have an account but moved off for security reasons.
Damn, that sucks. I didn't know OpenCode was this bad when it came to privacy.
This is one of the reasons I don't trust opencode. It looked very nice on paper when it first came out and there were no alternatives. However, today I'd probably stick with simple pi setup (not sure how much better than opencode, but it looks like they don't have all this cloud stuff) or just use one of the big tech agents and call it a day.
If i dont use any of their models nor i am signed in, is that a problem? i dont see anything in wireshark except for models.opencode.ai
I love the smell of misinformation in the morning. All it ever did was give people free model for title gen, if they didn't set one themselves. Feature you could disable or set on your own model. That was since removed, so now there is no free fallback model.
That is it. It is still private by default
> All it ever did was give people free model for title gen,
All it "ever did" was send your entire prompt/context to a "free" model for harvesting. The astroturfing in this thread is absurd.
It sent the prompt to a GPT-5-nano model with the max zdr you can get on openai. That was done to give people free title gen, unless they set it themselves. Title gen does not send anything but the prompt.
Maybe try a sensible approach first, cause so far this is assumed, for no reason, to be done maliciously. "to steal data" and the like.
Opencode's source code is public, so you can verify any claim against it directly.
but the prompt was sent to OpenAI via Opencode's servers right? So even when you use a local model, Opencode can still see your prompt by default?
It was going through zen, so they CAN see it if they want to. Same applies to anything on Zen. But, zen is ZDR. Same goes to any provider, ZDR or not, as ZDR is just an agreement. With Openai - caveats apply on Openai side itself(they retain logs regardless).
During this short period - yes. Unless it finds a valid small model, or you set one yourself - it would use the one provided by zen. or you could disable it with an invalid model altogether. Good gesture for most users and something else to others.
It's *could by the way, as this was only a short window when this was a thing. It went back to not having this fallback pretty fast, i don't think it even lasted a month.